scottk/OpenCellular
1
0
Fork 0
mirror of https://github.com/Telecominfraproject/OpenCellular.git synced 2026-01-10 17:41:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

spi: Fix OOBE in bounds-checking the reply

Browse Source 
There was an off-by-one error in bounds checking the reply.  You could
trigger it with pydevi2c with:

>>> tps = I2CDevice(20, 0x48, force=True)
>>> tps.Get(0, 249)

The EC would show:
  ASSERTION FAILURE 'msg_len < sizeof(out_msg)' in reply() at
  chip/stm32/spi.c:184

BUG=chrome-os-partner:18778
BRANCH=none
TEST=Run the above commands and see no error.

Change-Id: I9789405a9d70c5dc3fa237504fea8f46a139386c
Signed-off-by: Doug Anderson <dianders@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/50254
Reviewed-by: Simon Glass <sjg@chromium.org>
This commit is contained in:
Doug Anderson
2013-05-06 21:31:52 -07:00
committed by ChromeBot
parent 37fcfb732c
commit 0fe217c745
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
chip/stm32/spi.c
View File

@@ -184,7 +184,7 @@ static void reply(struct dma_channel *txdma,
msg[i + SPI_MSG_HEADER_LEN] = ch;
}
msg_len += SPI_MSG_PROTO_LEN;
ASSERT(msg_len < sizeof(out_msg));
ASSERT(msg_len <= sizeof(out_msg));
/* Add the checksum and get ready to send */
msg[msg_len - 2] = sum & 0xff;