From 69ef356b2c543db1cc7dcb98bac09fe9fb3588e3 Mon Sep 17 00:00:00 2001 From: "Mark M. Hoffman" Date: Wed, 6 Aug 2003 03:11:40 +0000 Subject: [PATCH] Prevent buffer overrun during SMBus Block Read when client responds (mmh) with illegal read size. Patch by Sergey Vlasov . git-svn-id: http://lm-sensors.org/svn/lm-sensors/trunk@1940 7894878c-1315-0410-8ee3-d5d059ff63e0 --- kernel/busses/i2c-viapro.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/busses/i2c-viapro.c b/kernel/busses/i2c-viapro.c index d999859b..9280d39d 100644 --- a/kernel/busses/i2c-viapro.c +++ b/kernel/busses/i2c-viapro.c @@ -264,6 +264,8 @@ static s32 vt596_access(struct i2c_adapter *adap, u16 addr, break; case VT596_BLOCK_DATA: data->block[0] = inb_p(SMBHSTDAT0); + if (data->block[0] > 32) + data->block[0] = 32; i = inb_p(SMBHSTCNT); /* Reset SMBBLKDAT */ for (i = 1; i <= data->block[0]; i++) data->block[i] = inb_p(SMBBLKDAT);