From 0514e9acd7655c708fbf12a659ea43d835bc688a Mon Sep 17 00:00:00 2001 From: Axel Lin Date: Mon, 16 May 2011 22:19:01 +0800 Subject: mfd: Fix off-by-one value range checking for tps65910_i2c_write If bytes == (TPS65910_MAX_REGISTER + 1), we have a buffer overflow when doing memcpy(&msg[1], src, bytes). Signed-off-by: Axel Lin Acked-by: Samuel Ortiz Signed-off-by: Liam Girdwood --- drivers/mfd/tps65910.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/mfd') diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c index bf649cf6a0ae..e31824870b9f 100644 --- a/drivers/mfd/tps65910.c +++ b/drivers/mfd/tps65910.c @@ -71,7 +71,7 @@ static int tps65910_i2c_write(struct tps65910 *tps65910, u8 reg, u8 msg[TPS65910_MAX_REGISTER + 1]; int ret; - if (bytes > (TPS65910_MAX_REGISTER + 1)) + if (bytes > TPS65910_MAX_REGISTER) return -EINVAL; msg[0] = reg; -- cgit v1.2.1