diff options
| author | Jan Engelmohr <jan.engelmohr@mailbox.tu-dresden.de> | 2016-08-01 13:31:29 +0200 |
|---|---|---|
| committer | Moyster <oysterized@gmail.com> | 2016-08-26 16:15:25 +0200 |
| commit | 97ef32aefecf27ce57455ac16a2da18ac7e2c1d6 (patch) | |
| tree | 813972e3812b6a7caf1464068e8c774e7334e962 /drivers/spi | |
| parent | 1e9ab116c0933c30e51bf68071eb822a90451a6d (diff) | |
3.10.76 -> 3.10.77
Diffstat (limited to 'drivers/spi')
| -rw-r--r-- | drivers/spi/spidev.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c index 911e9e071..a08f923b9 100644 --- a/drivers/spi/spidev.c +++ b/drivers/spi/spidev.c @@ -243,7 +243,10 @@ static int spidev_message(struct spidev_data *spidev, k_tmp->len = u_tmp->len; total += k_tmp->len; - if (total > bufsiz) { + /* Check total length of transfers. Also check each + * transfer length to avoid arithmetic overflow. + */ + if (total > bufsiz || k_tmp->len > bufsiz) { status = -EMSGSIZE; goto done; } |