Messages in this thread | | | Date | Tue, 10 May 2016 00:44:02 +0200 | From | Samuel Thibault <> | Subject | Re: [PATCH] staging: speakup: ensure we do not overrun synths array |
| |
Colin King, on Mon 09 May 2016 23:22:14 +0100, wrote: > From: Colin Ian King <colin.king@canonical.com> > > synth_add allows one to add MAXSYNTHS synths to the synths array; > however it always NULLifies the next synth in the array which > means that on the MAXSYNTHS synth we get an out-of-bounds write of > the NULL to the synths array. Make the synths array MAXSYNTHS + 1 > elements in size to allow for the final NULL sentinal to avoid the > out-of-bounds write. > > Issue found wit CoverityScan, CID#744671 > > Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
> --- > drivers/staging/speakup/synth.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/staging/speakup/synth.c b/drivers/staging/speakup/synth.c > index 4f462c3..810a214 100644 > --- a/drivers/staging/speakup/synth.c > +++ b/drivers/staging/speakup/synth.c > @@ -18,7 +18,7 @@ > #include "serialio.h" > > #define MAXSYNTHS 16 /* Max number of synths in array. */ > -static struct spk_synth *synths[MAXSYNTHS]; > +static struct spk_synth *synths[MAXSYNTHS + 1]; > struct spk_synth *synth; > char spk_pitch_buff[32] = ""; > static int module_status; > -- > 2.8.1 >
-- Samuel Actually, typing random strings in the Finder does the equivalent of filename completion. (Discussion in comp.os.linux.misc on the intuitiveness of commands: file completion vs. the Mac Finder.)
| |