diff options
Diffstat (limited to 'drivers/spi/spidev.c')
| -rw-r--r-- | drivers/spi/spidev.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c index e50039fb1474..409a8c576c7a 100644 --- a/drivers/spi/spidev.c +++ b/drivers/spi/spidev.c @@ -246,7 +246,10 @@ static int spidev_message(struct spidev_data *spidev, k_tmp->len = u_tmp->len; total += k_tmp->len; - if (total > bufsiz) { + /* Check total length of transfers. Also check each + * transfer length to avoid arithmetic overflow. + */ + if (total > bufsiz || k_tmp->len > bufsiz) { status = -EMSGSIZE; goto done; } |