diff options
| author | Bill Richardson <wfrichar@chromium.org> | 2012-07-13 13:02:52 -0700 |
|---|---|---|
| committer | Gerrit <chrome-bot@google.com> | 2012-07-13 15:24:17 -0700 |
| commit | 280aeb754dc8301c9f364d8c2927dd672ab83103 (patch) | |
| tree | 80f613c232c6cfd38e434ecb980d77e928b53906 | |
| parent | 0939fffdebee1e8326d2b2c898433ab28db1ded1 (diff) | |
| download | chrome-ec-280aeb754dc8301c9f364d8c2927dd672ab83103.tar.gz | |
Security fix: validate index in controller_write()
Make sure it doesn't run off the end of the I2C device list.
BUG=chrome-os-partner:11051
TEST=manual
No visible changes. Everything should continue to work.
Change-Id: I43182361cda6be578e57acef01afb27260cea80a
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/27390
Reviewed-by: Randall Spangler <rspangler@chromium.org>
| -rw-r--r-- | common/lightbar.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/common/lightbar.c b/common/lightbar.c index bb7805c98d..da655eff55 100644 --- a/common/lightbar.c +++ b/common/lightbar.c @@ -31,12 +31,14 @@ static const uint8_t i2c_addr[] = { 0x54, 0x56 }; static inline void controller_write(int ctrl_num, uint8_t reg, uint8_t val) { + ctrl_num = ctrl_num % ARRAY_SIZE(i2c_addr); i2c_write8(I2C_PORT_LIGHTBAR, i2c_addr[ctrl_num], reg, val); } static inline uint8_t controller_read(int ctrl_num, uint8_t reg) { int val = 0; + ctrl_num = ctrl_num % ARRAY_SIZE(i2c_addr); i2c_read8(I2C_PORT_LIGHTBAR, i2c_addr[ctrl_num], reg, &val); return val; } |