diff options
| author | Doug Anderson <dianders@chromium.org> | 2013-05-06 21:31:52 -0700 |
|---|---|---|
| committer | ChromeBot <chrome-bot@google.com> | 2013-05-07 20:59:28 -0700 |
| commit | 0fe217c745406dd562d875ee845a73f8783339b8 (patch) | |
| tree | 4931a5898468ec06e38760953e7a4424e447bd6a /chip/stm32/spi.c | |
| parent | 37fcfb732c518cd43df58048d8da10c44a055785 (diff) | |
| download | chrome-ec-0fe217c745406dd562d875ee845a73f8783339b8.tar.gz | |
spi: Fix OOBE in bounds-checking the reply
There was an off-by-one error in bounds checking the reply. You could
trigger it with pydevi2c with:
>>> tps = I2CDevice(20, 0x48, force=True)
>>> tps.Get(0, 249)
The EC would show:
ASSERTION FAILURE 'msg_len < sizeof(out_msg)' in reply() at
chip/stm32/spi.c:184
BUG=chrome-os-partner:18778
BRANCH=none
TEST=Run the above commands and see no error.
Change-Id: I9789405a9d70c5dc3fa237504fea8f46a139386c
Signed-off-by: Doug Anderson <dianders@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/50254
Reviewed-by: Simon Glass <sjg@chromium.org>
Diffstat (limited to 'chip/stm32/spi.c')
| -rw-r--r-- | chip/stm32/spi.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/chip/stm32/spi.c b/chip/stm32/spi.c index 79a08a9e68..ac844f198d 100644 --- a/chip/stm32/spi.c +++ b/chip/stm32/spi.c @@ -184,7 +184,7 @@ static void reply(struct dma_channel *txdma, msg[i + SPI_MSG_HEADER_LEN] = ch; } msg_len += SPI_MSG_PROTO_LEN; - ASSERT(msg_len < sizeof(out_msg)); + ASSERT(msg_len <= sizeof(out_msg)); /* Add the checksum and get ready to send */ msg[msg_len - 2] = sum & 0xff; |