Skip to content

Commit

Permalink
i2c: fix dereference beyond the end of buffer
Browse files Browse the repository at this point in the history
Print the contents of the buffer as an array of bytes in hex, which
avoids endian issues and reading beyond the end of the buffer.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
  • Loading branch information
npiggin authored and oohal committed Dec 16, 2019
1 parent e04a34a commit bca23d3
Showing 1 changed file with 10 additions and 2 deletions.
12 changes: 10 additions & 2 deletions core/i2c.c
Expand Up @@ -138,6 +138,8 @@ int64_t i2c_request_sync(struct i2c_request *req)
uint64_t timer_period = msecs_to_tb(5), timer_count;
uint64_t time_to_wait = 0;
int64_t rc, waited, retries;
size_t i, count;
char buf[17]; /* 8 bytes in hex + NUL */

for (retries = 0; retries <= MAX_NACK_RETRIES; retries++) {
waited = 0;
Expand Down Expand Up @@ -175,10 +177,16 @@ int64_t i2c_request_sync(struct i2c_request *req)
req->req_state = i2c_req_new;
}

prlog(PR_DEBUG, "I2C: %s req op=%x offset=%x buf=%016llx buflen=%d "
count = 0;
for (i = 0; i < req->rw_len && count < sizeof(buf); i++) {
count += snprintf(buf+count, sizeof(buf)-count, "%02x",
*(unsigned char *)(req->rw_buf+i));
}

prlog(PR_DEBUG, "I2C: %s req op=%x offset=%x buf=%s buflen=%d "
"delay=%lu/%lld rc=%lld\n",
(rc) ? "!!!!" : "----", req->op, req->offset,
*(uint64_t*) req->rw_buf, req->rw_len, tb_to_msecs(waited), req->timeout, rc);
buf, req->rw_len, tb_to_msecs(waited), req->timeout, rc);

return rc;
}
Expand Down

0 comments on commit bca23d3

Please sign in to comment.