lkml.org 
[lkml]   [2006]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[2.6 patch] fix array overrun in drivers/char/mwave/mwavedd.c
From: Eric Sesterhenn <snakebyte@gmx.de>

this fixes coverity id #489.
Since the last element in the array is always ARRAY_SIZE-1
we have to check for ipcnum >= ARRAY_SIZE()

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>

---

This patch was sent by Eric Sesterhenn on:
- 9 Apr 2006

--- linux-2.6.17-rc1/drivers/char/mwave/mwavedd.c.orig 2006-04-09 19:45:54.000000000 +0200
+++ linux-2.6.17-rc1/drivers/char/mwave/mwavedd.c 2006-04-09 19:46:07.000000000 +0200
@@ -271,7 +271,7 @@ static int mwave_ioctl(struct inode *ino
ipcnum,
pDrvData->IPCs[ipcnum].usIntCount);

- if (ipcnum > ARRAY_SIZE(pDrvData->IPCs)) {
+ if (ipcnum >= ARRAY_SIZE(pDrvData->IPCs)) {
PRINTK_ERROR(KERN_ERR_MWAVE
"mwavedd::mwave_ioctl:"
" IOCTL_MW_REGISTER_IPC:"

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-04-23 23:25    [W:2.133 / U:0.376 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site