Changeset 4004

Show
Ignore:
Timestamp:
09/24/05 22:37:39 (3 years ago)
Author:
khali
Message:

Fix temporary buffer size for SMBus Block Write transaction with
software PEC. Fix buffer overrun in SMBus Block Write and Block Process
Call transactions. Patches from Hideki Iwamoto.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • i2c/trunk/kernel/i2c-core.c

    r4003 r4004  
    12171217          most things with sane defaults, to keep the code below somewhat 
    12181218          simpler. */ 
    1219         unsigned char msgbuf0[I2C_SMBUS_BLOCK_MAX+2]; 
     1219        unsigned char msgbuf0[I2C_SMBUS_BLOCK_MAX+3]; 
    12201220        unsigned char msgbuf1[I2C_SMBUS_BLOCK_MAX+2]; 
    12211221        int num = read_write == I2C_SMBUS_READ?2:1; 
    …… 
    12931293                        if(size == I2C_SMBUS_BLOCK_DATA_PEC) 
    12941294                                (msg[0].len)++; 
    1295                         for (i = 1; i <= msg[0].len; i++) 
     1295                        for (i = 1; i < msg[0].len; i++) 
    12961296                                msgbuf0[i] = data->block[i-1]; 
    12971297                } 
    …… 
    13161316                        return -1; 
    13171317                } 
    1318                 for (i = 1; i <= msg[0].len; i++) 
     1318                for (i = 1; i < msg[0].len; i++) 
    13191319                        msgbuf0[i] = data->block[i-1]; 
    13201320