| Message ID | 20250513172330.1b6897d3@endymion |
|---|---|
| State | New |
| Headers | show |
| Series | [1/3] i2ctransfer: Don't free memory which was never allocated | expand |
On Tue, May 13, 2025 at 05:23:30PM +0200, Jean Delvare wrote: > There's an off-by-one bug in the message count check to ensure that we > do not process more messages than the kernel allows. nmsgs points to > the index within msgs[] which would be used for the _next_ message. If > this index is equal the maximum number of messages then we must stop > already. > > This closes bug #220112: > https://bugzilla.kernel.org/show_bug.cgi?id=220112 > > Fixes: 9fc53a7fc669 ("i2c-tools: add new tool 'i2ctransfer'") > Signed-off-by: Jean Delvare <jdelvare@suse.de> Applied, thanks!
--- i2c-tools.orig/tools/i2ctransfer.c +++ i2c-tools/tools/i2ctransfer.c @@ -193,7 +193,7 @@ int main(int argc, char *argv[]) __u8 data, *buf; char *end; - if (nmsgs > I2C_RDRW_IOCTL_MAX_MSGS) { + if (nmsgs == I2C_RDRW_IOCTL_MAX_MSGS) { fprintf(stderr, "Error: Too many messages (max: %d)\n", I2C_RDRW_IOCTL_MAX_MSGS); goto err_out;
There's an off-by-one bug in the message count check to ensure that we do not process more messages than the kernel allows. nmsgs points to the index within msgs[] which would be used for the _next_ message. If this index is equal the maximum number of messages then we must stop already. This closes bug #220112: https://bugzilla.kernel.org/show_bug.cgi?id=220112 Fixes: 9fc53a7fc669 ("i2c-tools: add new tool 'i2ctransfer'") Signed-off-by: Jean Delvare <jdelvare@suse.de> --- tools/i2ctransfer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)