Input: atmel_mxt_ts - Add check for writing outside object bounds

Signed-off-by: Nick Dyer <nick.dyer@itdev.co.uk>

1 files changed, 6 insertions, 0 deletions

diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index def6698d4176..4b4930cec975 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -509,6 +509,12 @@ static int mxt_write_object(struct mxt_data *data,
 	if (!object || offset >= object->size)
 		return -EINVAL;
 
+	if (offset >= object->size * object->instances) {
+		dev_err(&data->client->dev, "Tried to write outside object T%d"
+			" offset:%d, size:%d\n", type, offset, object->size);
+		return -EINVAL;
+	}
+
 	reg = object->start_address;
 	return mxt_write_reg(data->client, reg + offset, val);
 }