lkml.org 
[lkml]   [2011]   [Feb]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] staging: rts_pstor: fix read past end of buffer
Date
From: wwang <wei_wang@realsil.com.cn>

Thanks Dan Carpenter <error27@gmail.com> who helps to find this bug.
There are two places where we read one space past the end of buffer.

Signed-off-by: wwang <wei_wang@realsil.com.cn>
---
drivers/staging/rts_pstor/ms.c | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/rts_pstor/ms.c b/drivers/staging/rts_pstor/ms.c
index dd59931..28d17c7 100644
--- a/drivers/staging/rts_pstor/ms.c
+++ b/drivers/staging/rts_pstor/ms.c
@@ -3361,8 +3361,8 @@ static int ms_rw_multi_sector(struct scsi_cmnd *srb, struct rtsx_chip *chip, u32
log_blk = (u16)(start_sector >> ms_card->block_shift);
start_page = (u8)(start_sector & ms_card->page_off);

- for (seg_no = 0; seg_no < sizeof(ms_start_idx)/2; seg_no++) {
- if (log_blk < ms_start_idx[seg_no+1])
+ for (seg_no = 0; seg_no < ARRAY_SIZE(ms_start_idx) - 1; seg_no++) {
+ if (log_blk < ms_start_idx[seg_no + 1])
break;
}

@@ -3494,8 +3494,8 @@ static int ms_rw_multi_sector(struct scsi_cmnd *srb, struct rtsx_chip *chip, u32

log_blk++;

- for (seg_no = 0; seg_no < sizeof(ms_start_idx)/2; seg_no++) {
- if (log_blk < ms_start_idx[seg_no+1])
+ for (seg_no = 0; seg_no < ARRAY_SIZE(ms_start_idx) - 1; seg_no++) {
+ if (log_blk < ms_start_idx[seg_no + 1])
break;
}

--
1.7.4


\
 
 \ /
  Last update: 2011-02-10 04:41    [W:0.029 / U:0.100 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site