Message ID | 1430905699-22704-1-git-send-email-luis.henriques@canonical.com |
---|---|
State | New |
Headers | show |
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c index e3bc23bb5883..621df17214a5 100644 --- a/drivers/spi/spidev.c +++ b/drivers/spi/spidev.c @@ -244,7 +244,10 @@ static int spidev_message(struct spidev_data *spidev, k_tmp->len = u_tmp->len; total += k_tmp->len; - if (total > bufsiz) { + /* Check total length of transfers. Also check each + * transfer length to avoid arithmetic overflow. + */ + if (total > bufsiz || k_tmp->len > bufsiz) { status = -EMSGSIZE; goto done; }