d4c6c60993
The 'regs' array has ASPEED_ADC_NR_REGS (52) elements, while the
memory region covers offsets 0x00-0xFC. The aspeed_adc_engine_write()
function has an out-of-bounds write vulnerability when accessing
unimplemented registers.
Fix this by using 'return' instead of 'break' in the default case,
which prevents execution from reaching the s->regs[reg] assignment for
unimplemented registers.
Reported-by: Elhrj Saad <saadelhrj@gmail.com>
Fixes:
|
||
|---|---|---|
| .. | ||
| aspeed_adc.c | ||
| Kconfig | ||
| meson.build | ||
| npcm7xx_adc.c | ||
| stm32f2xx_adc.c | ||
| trace-events | ||
| trace.h | ||
| zynq-xadc.c | ||