Annotation of /trunk/kernel26-magellan/patches-2.6.16-r12/0106-2.6.16.12-usb-overflow.patch
Parent Directory | Revision Log
Revision 72 -
(hide annotations)
(download)
Mon Jun 5 09:25:38 2006 UTC (18 years, 3 months ago) by niro
File size: 1502 byte(s)
Mon Jun 5 09:25:38 2006 UTC (18 years, 3 months ago) by niro
File size: 1502 byte(s)
ver bump to 2.6.16-r12: - updated to linux-2.6.16.19 - updated to ck11
1 | niro | 72 | From: Eric Sesterhenn <snakebyte@gmx.de> |
2 | Date: Sun, 23 Apr 2006 20:52:28 +0000 (+0200) | ||
3 | Subject: [PATCH] USB: fix array overrun in drivers/usb/serial/option.c | ||
4 | X-Git-Url: http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=commitdiff;h=5e8273250e73d3e2c4e67d0480dcb54e972f5023 | ||
5 | |||
6 | [PATCH] USB: fix array overrun in drivers/usb/serial/option.c | ||
7 | |||
8 | since the arrays are declared as in_urbs[N_IN_URB] | ||
9 | and out_urbs[N_OUT_URB] both for loops, go one | ||
10 | over the end of the array. This fixes coverity id #555 | ||
11 | |||
12 | This patch was already included in Linus' tree. | ||
13 | |||
14 | Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de> | ||
15 | Signed-off-by: Adrian Bunk <bunk@stusta.de> | ||
16 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | ||
17 | --- | ||
18 | |||
19 | --- a/drivers/usb/serial/option.c | ||
20 | +++ b/drivers/usb/serial/option.c | ||
21 | @@ -582,14 +582,14 @@ static void option_setup_urbs(struct usb | ||
22 | portdata = usb_get_serial_port_data(port); | ||
23 | |||
24 | /* Do indat endpoints first */ | ||
25 | - for (j = 0; j <= N_IN_URB; ++j) { | ||
26 | + for (j = 0; j < N_IN_URB; ++j) { | ||
27 | portdata->in_urbs[j] = option_setup_urb (serial, | ||
28 | port->bulk_in_endpointAddress, USB_DIR_IN, port, | ||
29 | portdata->in_buffer[j], IN_BUFLEN, option_indat_callback); | ||
30 | } | ||
31 | |||
32 | /* outdat endpoints */ | ||
33 | - for (j = 0; j <= N_OUT_URB; ++j) { | ||
34 | + for (j = 0; j < N_OUT_URB; ++j) { | ||
35 | portdata->out_urbs[j] = option_setup_urb (serial, | ||
36 | port->bulk_out_endpointAddress, USB_DIR_OUT, port, | ||
37 | portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback); |