diff mbox series

[2/3] i2ctransfer: Prevent msgs[] overflow with many parameters

Message ID 20250513172330.1b6897d3@endymion
State New
Headers show
Series [1/3] i2ctransfer: Don't free memory which was never allocated | expand

Commit Message

Jean Delvare May 13, 2025, 3:23 p.m. UTC 
There's an off-by-one bug in the message count check to ensure that we
do not process more messages than the kernel allows. nmsgs points to
the index within msgs[] which would be used for the _next_ message. If
this index is equal the maximum number of messages then we must stop
already.

This closes bug #220112:
https://bugzilla.kernel.org/show_bug.cgi?id=220112

Fixes: 9fc53a7fc669 ("i2c-tools: add new tool 'i2ctransfer'")
Signed-off-by: Jean Delvare <jdelvare@suse.de>
---
 tools/i2ctransfer.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

--- i2c-tools.orig/tools/i2ctransfer.c
+++ i2c-tools/tools/i2ctransfer.c
@@ -193,7 +193,7 @@  int main(int argc, char *argv[])
 		__u8 data, *buf;
 		char *end;
 
-		if (nmsgs > I2C_RDRW_IOCTL_MAX_MSGS) {
+		if (nmsgs == I2C_RDRW_IOCTL_MAX_MSGS) {
 			fprintf(stderr, "Error: Too many messages (max: %d)\n",
 				I2C_RDRW_IOCTL_MAX_MSGS);
 			goto err_out;