From b0cef9e0089c8bbbdbc6c7ba11f88737a0942189 Mon Sep 17 00:00:00 2001 From: Eero Nurkkala Date: Mon, 6 Nov 2023 17:25:13 +0200 Subject: [PATCH] risc-v/mpfs: i2c: prevent out of bounds read access priv->msgid may grow past its boundaries, causing struct i2c_msg_s *msg = &priv->msgv[priv->msgid] to read data out of boundaris. Signed-off-by: Eero Nurkkala --- arch/risc-v/src/mpfs/mpfs_i2c.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/risc-v/src/mpfs/mpfs_i2c.c b/arch/risc-v/src/mpfs/mpfs_i2c.c index 26fa4408eb..7748db1f0f 100644 --- a/arch/risc-v/src/mpfs/mpfs_i2c.c +++ b/arch/risc-v/src/mpfs/mpfs_i2c.c @@ -493,7 +493,10 @@ static int mpfs_i2c_irq(int cpuint, void *context, void *arg) /* Jump to the next message */ - priv->msgid++; + if (priv->msgid < (priv->msgc - 1)) + { + priv->msgid++; + } } else { @@ -512,7 +515,10 @@ static int mpfs_i2c_irq(int cpuint, void *context, void *arg) /* Jump to the next message */ - priv->msgid++; + if (priv->msgid < (priv->msgc - 1)) + { + priv->msgid++; + } } else {