diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-02-27 15:16:29 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-02-27 15:16:29 -0800 |
| commit | 17de1566e170f4f30f8dda66ab9e668fbf1d5526 (patch) | |
| tree | d986981330bda13fe789a9e9fe59dfbea05793be /drivers/usb | |
| parent | 3bf75ddd22dc6e7303e962a262c8d64e5ab87b15 (diff) | |
| parent | c39b242b643da24676fd02ea83f6b6aba0a4d69a (diff) | |
Merge "usb: pd: Avoid buffer overrun during msg_rx"
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/pd/policy_engine.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/pd/policy_engine.c b/drivers/usb/pd/policy_engine.c index ea278781440c..935bd0778bfb 100644 --- a/drivers/usb/pd/policy_engine.c +++ b/drivers/usb/pd/policy_engine.c @@ -665,7 +665,7 @@ static void phy_msg_received(struct usbpd *pd, enum pd_msg_type type, rx_msg->type = PD_MSG_HDR_TYPE(header); rx_msg->len = PD_MSG_HDR_COUNT(header); - memcpy(&rx_msg->payload, buf, len); + memcpy(&rx_msg->payload, buf, min(len, sizeof(rx_msg->payload))); spin_lock_irqsave(&pd->rx_lock, flags); list_add_tail(&rx_msg->entry, &pd->rx_q); |