Dan Carpenter 690b2549b1 i2c: ismt: prevent memory corruption in ismt_access() ... The "data->block[0]" variable comes from the user and is a number between 0-255. It needs to be capped to prevent writing beyond the end of dma_buffer[]. Fixes: 5e9a97b1f4 ("i2c: ismt: Adding support for I2C_SMBUS_BLOCK_PROC_CALL") Reported-and-tested-by: Zheyu Ma <zheyuma97@gmail.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2022-06-02 08:40:56 -07:00
..
algos
busses	i2c: ismt: prevent memory corruption in ismt_access()	2022-06-02 08:40:56 -07:00
muxes
i2c-boardinfo.c
i2c-core-acpi.c
i2c-core-base.c
i2c-core-of.c
i2c-core-slave.c
i2c-core-smbus.c
i2c-core.h
i2c-dev.c
i2c-mux.c
i2c-slave-eeprom.c
i2c-slave-testunit.c
i2c-smbus.c
i2c-stub.c
Kconfig
Makefile