From ae5820f24bcb12ab21bc6296f8b67e40474ab86f Mon Sep 17 00:00:00 2001
From: Daniel Kurtz <djkurtz@chromium.org>
Date: Tue, 8 May 2012 22:38:52 -0700
Subject: [PATCH] --- yaml --- r: 306613 b: refs/heads/master c:
 d1ff320f0a9766a53ae412d96f72bd861a889af6 h: refs/heads/master i:   306611:
 a98df5e6513f01e10892cef75f500235c62ef6d8 v: v3

---
 [refs]                                         | 2 +-
 trunk/drivers/input/touchscreen/atmel_mxt_ts.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index 5b86799be04b..946c398a9e39 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 71b3e938cb97f6cf324fb5aaca46d8e400dc38f0
+refs/heads/master: d1ff320f0a9766a53ae412d96f72bd861a889af6
diff --git a/trunk/drivers/input/touchscreen/atmel_mxt_ts.c b/trunk/drivers/input/touchscreen/atmel_mxt_ts.c
index 15ae6fd575b2..8f0dc7776e7d 100644
--- a/trunk/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/trunk/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -506,7 +506,7 @@ static int mxt_write_object(struct mxt_data *data,
 	u16 reg;
 
 	object = mxt_get_object(data, type);
-	if (!object)
+	if (!object || offset >= object->size + 1)
 		return -EINVAL;
 
 	reg = object->start_address;