Input: atmel_mxt_ts - verify object size in mxt_write_object

Don't allow writing past the length of an object.

Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 15ae6fd575b2ba1a472648206b58af108ff0759b..8f0dc7776e7da7f3673e82bd9a0a214cfb756ba2 100644 (file)
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -506,7 +506,7 @@ static int mxt_write_object(struct mxt_data *data,
        u16 reg;
 
        object = mxt_get_object(data, type);
-       if (!object)
+       if (!object || offset >= object->size + 1)
                return -EINVAL;
 
        reg = object->start_address;