diff options
| author | Randall Spangler <rspangler@chromium.org> | 2012-06-12 14:43:43 -0700 |
|---|---|---|
| committer | Gerrit <chrome-bot@google.com> | 2012-06-12 15:56:35 -0700 |
| commit | 3aacc3a9183b91639d03eed4573c1a15a5ad5f28 (patch) | |
| tree | 2e1efd4a264ff528d59f2e35c0fabcd47edcffdd | |
| parent | 801a90c3fcee004db153940810371b3d06e37b35 (diff) | |
| download | chrome-ec-3aacc3a9183b91639d03eed4573c1a15a5ad5f28.tar.gz | |
Size-check EC LPC response size
Note that util/comm-lpc.c already does this for the host side of the
commnunication.
BUG=chrome-os-partner:10444
TEST=none; all EC responses are currently well-formed
(but do try 'ectool hello' from host and make sure it still works)
Change-Id: I731ed326e281be6a7435edfa03c783225e105b72
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/25124
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
| -rw-r--r-- | chip/lm4/lpc.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/chip/lm4/lpc.c b/chip/lm4/lpc.c index fda63c7761..b44ff86005 100644 --- a/chip/lm4/lpc.c +++ b/chip/lm4/lpc.c @@ -155,6 +155,12 @@ void host_send_response(int slot, const uint8_t *data, int size) { uint8_t *out = host_get_buffer(slot); + /* Fail if response doesn't fit in the param buffer */ + if (size < 0 || size > EC_PARAM_SIZE) { + host_send_result(slot, EC_RES_ERROR); + return; + } + if (data != out) memcpy(out, data, size); |