diff options
| author | Corey Minyard <cminyard@mvista.com> | 2018-12-03 06:52:50 -0600 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2019-04-01 20:36:21 -0500 |
| commit | a69e9049d6abb90e9fe6b6d54829cb51c9fc3cbe (patch) | |
| tree | 077cff09285add666654526f7bbc36e58559b9e9 | |
| parent | 22acdb9937fd87244f0775ec49f50470fd4340c6 (diff) | |
i2c: Add a length check to the SMBus write handling
Avoid an overflow.
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Cc: QEMU Stable <qemu-stable@nongnu.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 629457a13080052c575779e1fd9f5eb5ee6b8ad9)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | hw/i2c/smbus.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/hw/i2c/smbus.c b/hw/i2c/smbus.c index 587ce1ab7f..639ff90b65 100644 --- a/hw/i2c/smbus.c +++ b/hw/i2c/smbus.c @@ -193,7 +193,11 @@ static int smbus_i2c_send(I2CSlave *s, uint8_t data) switch (dev->mode) { case SMBUS_WRITE_DATA: DPRINTF("Write data %02x\n", data); - dev->data_buf[dev->data_len++] = data; + if (dev->data_len >= sizeof(dev->data_buf)) { + BADF("Too many bytes sent\n"); + } else { + dev->data_buf[dev->data_len++] = data; + } break; default: BADF("Unexpected write in state %d\n", dev->mode); |