From d1ff320f0a9766a53ae412d96f72bd861a889af6 Mon Sep 17 00:00:00 2001 From: Daniel Kurtz Date: Tue, 8 May 2012 22:38:52 -0700 Subject: [PATCH] Input: atmel_mxt_ts - verify object size in mxt_write_object Don't allow writing past the length of an object. Signed-off-by: Daniel Kurtz Signed-off-by: Dmitry Torokhov --- drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c index 15ae6fd575b2..8f0dc7776e7d 100644 --- a/drivers/input/touchscreen/atmel_mxt_ts.c +++ b/drivers/input/touchscreen/atmel_mxt_ts.c @@ -506,7 +506,7 @@ static int mxt_write_object(struct mxt_data *data, u16 reg; object = mxt_get_object(data, type); - if (!object) + if (!object || offset >= object->size + 1) return -EINVAL; reg = object->start_address; -- 2.30.2