Skip to content
Commit 62ac2473 authored by Harshit Mogalapalli's avatar Harshit Mogalapalli Committed by Jiri Kosina
Browse files

HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()



Smatch Warning:
drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy()
'&mcp->txbuf[5]' too small (59 vs 255)
drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy() 'buf'
too small (34 vs 255)

The 'len' variable can take a value between 0-255 as it can come from
data->block[0] and it is user data. So add an bound check to prevent a
buffer overflow in memcpy().

Fixes: 67a95c21 ("HID: mcp2221: add usb to i2c-smbus host bridge")
Signed-off-by: default avatarHarshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 54eed5c7
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment