i2c: Add a length check to the SMBus write handling
Avoid an overflow.
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Cc: QEMU Stable <qemu-stable@nongnu.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 629457a130
)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
stable-3.0
parent
22acdb9937
commit
a69e9049d6
|
@ -193,7 +193,11 @@ static int smbus_i2c_send(I2CSlave *s, uint8_t data)
|
|||
switch (dev->mode) {
|
||||
case SMBUS_WRITE_DATA:
|
||||
DPRINTF("Write data %02x\n", data);
|
||||
dev->data_buf[dev->data_len++] = data;
|
||||
if (dev->data_len >= sizeof(dev->data_buf)) {
|
||||
BADF("Too many bytes sent\n");
|
||||
} else {
|
||||
dev->data_buf[dev->data_len++] = data;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
BADF("Unexpected write in state %d\n", dev->mode);
|
||||
|
|
Loading…
Reference in New Issue