From 0fe217c745406dd562d875ee845a73f8783339b8 Mon Sep 17 00:00:00 2001 From: Doug Anderson Date: Mon, 6 May 2013 21:31:52 -0700 Subject: [PATCH] spi: Fix OOBE in bounds-checking the reply There was an off-by-one error in bounds checking the reply. You could trigger it with pydevi2c with: >>> tps = I2CDevice(20, 0x48, force=True) >>> tps.Get(0, 249) The EC would show: ASSERTION FAILURE 'msg_len < sizeof(out_msg)' in reply() at chip/stm32/spi.c:184 BUG=chrome-os-partner:18778 BRANCH=none TEST=Run the above commands and see no error. Change-Id: I9789405a9d70c5dc3fa237504fea8f46a139386c Signed-off-by: Doug Anderson Reviewed-on: https://gerrit.chromium.org/gerrit/50254 Reviewed-by: Simon Glass --- chip/stm32/spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chip/stm32/spi.c b/chip/stm32/spi.c index 79a08a9e68..ac844f198d 100644 --- a/chip/stm32/spi.c +++ b/chip/stm32/spi.c @@ -184,7 +184,7 @@ static void reply(struct dma_channel *txdma, msg[i + SPI_MSG_HEADER_LEN] = ch; } msg_len += SPI_MSG_PROTO_LEN; - ASSERT(msg_len < sizeof(out_msg)); + ASSERT(msg_len <= sizeof(out_msg)); /* Add the checksum and get ready to send */ msg[msg_len - 2] = sum & 0xff;