Messages in this thread | | | Subject | Re: [patch] video: fbdev: metronomefb: two harmless off by one bugs | From | Tomi Valkeinen <> | Date | Tue, 16 Feb 2016 14:53:30 +0200 |
| |
On 30/01/16 16:44, Dan Carpenter wrote: > par->metromem_cmd->args[] is an array of 31 elements of size u16. Here > we have initialized the first "i" elements and want to set the rest to > zero. > > The issue here is that ARRAY_SIZE(par->metromem_cmd->args) is 31 and not > 32 as in the original code. It means that we set ->csum to zero, but > that is harmless because we immediately set it to the correct value on > the next line. > > Still, the buffer overflow upsets static checkers so let's correct the > math.
Thanks, queued for 4.6.
Tomi
[unhandled content-type:application/pgp-signature]
| |