[PATCH] i2cset: fix 'i' & 's' modes otherwise 3 extra bytes are sent

Avi Fishman AviFishman70 at gmail.com
Mon Oct 2 12:17:58 UTC 2017


When 'i' or 's' modes are selected block array is filled from offset 3
(blen = 3) but copied to data.block buffer from offset 0 so first 3 bytes
contains garbage from stack.
The buffer that is sent is also 3 bytes too long due to those extra 3
bytes.

Signed-off-by: Avi Fishman <AviFishman70 at gmail.com>
---
 miscutils/i2c_tools.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/miscutils/i2c_tools.c b/miscutils/i2c_tools.c
index fc392d9dc..0f6ec8983 100644
--- a/miscutils/i2c_tools.c
+++ b/miscutils/i2c_tools.c
@@ -616,8 +616,9 @@ int i2cset_main(int argc, char **argv)
 	case I2C_SMBUS_BLOCK_DATA:
 	case I2C_SMBUS_I2C_BLOCK_DATA:
 		for (blen = 3; blen < (argc - 1); blen++)
-			block[blen] = xstrtou_range(argv[blen], 0, 0, 0xff);
+			block[blen - 3] = xstrtou_range(argv[blen], 0, 0, 0xff);
 		val = -1;
+		blen -= 3;
 		break;
 	default:
 		val = -1;
-- 
2.14.1



More information about the busybox mailing list