diff options
| author | Michael Auchter <michael.auchter@ni.com> | 2020-01-20 16:03:33 -0600 |
|---|---|---|
| committer | Commit Bot <commit-bot@chromium.org> | 2020-01-24 06:54:51 +0000 |
| commit | 20652520d6004778a447d01c6dac2bc5d4a76d68 (patch) | |
| tree | c8ee4735cd6c56d37bff18bb782150feec295b9e /common/ioexpander.c | |
| parent | 62fdd8eceefa930d5d66ba356f71d9c03693ea20 (diff) | |
| download | chrome-ec-20652520d6004778a447d01c6dac2bc5d4a76d68.tar.gz | |
ioexpander: fix out-of-bounds access in last_val_changed
Commit 9f392b0d6 gave unique values to IO signals implemented on an IO
expander, but last_val_changed was not updated to remove the newly added
offset before indexing the array that tracks changes between `ioexget`
invocations.
Remove the offset and add an assertion to ensure the array index is
valid.
BUG=None
BRANCH=None
TEST=`ioexget` doesn't assert or stomp on memory
Signed-off-by: Michael Auchter <michael.auchter@ni.com>
Change-Id: If06d300abaeed2905939d9724a1152d4da10035b
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/2012448
Reviewed-by: Edward Hill <ecgh@chromium.org>
Commit-Queue: Edward Hill <ecgh@chromium.org>
Tested-by: Edward Hill <ecgh@chromium.org>
Diffstat (limited to 'common/ioexpander.c')
| -rw-r--r-- | common/ioexpander.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/common/ioexpander.c b/common/ioexpander.c index 6b54fd635e..e130e77a8a 100644 --- a/common/ioexpander.c +++ b/common/ioexpander.c @@ -16,8 +16,12 @@ static uint8_t last_val[(IOEX_COUNT + 7) / 8]; -static int last_val_changed(int i, int v) +static int last_val_changed(enum ioex_signal signal, int v) { + const int i = signal - IOEX_SIGNAL_START; + + ASSERT(signal_is_ioex(signal)); + if (v && !(last_val[i / 8] & (BIT(i % 8)))) { last_val[i / 8] |= BIT(i % 8); return 1; |