Commit 62ac2473 authored by Harshit Mogalapalli's avatar Harshit Mogalapalli Committed by Jiri Kosina
Browse files

HID: mcp2221: prevent a buffer overflow in mcp_smbus_write() 



Smatch Warning:
drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy()
'&mcp->txbuf[5]' too small (59 vs 255)
drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy() 'buf'
too small (34 vs 255)

The 'len' variable can take a value between 0-255 as it can come from
data->block[0] and it is user data. So add an bound check to prevent a
buffer overflow in memcpy().

Fixes: 67a95c21 ("HID: mcp2221: add usb to i2c-smbus host bridge")
Signed-off-by: default avatarHarshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 54eed5c7

drivers/hid/hid-mcp2221.c

+3 −0
Original line number Diff line number Diff line
@@ -385,6 +385,9 @@ static int mcp_smbus_write(struct mcp2221 *mcp, u16 addr, 
		data_len = 7;

		break;

	default:

		if (len > I2C_SMBUS_BLOCK_MAX)

			return -EINVAL;



		memcpy(&mcp->txbuf[5], buf, len);

		data_len = len + 5;

	}