From: Eric Sesterhenn Date: Sun, 23 Apr 2006 20:52:28 +0000 (+0200) Subject: [PATCH] USB: fix array overrun in drivers/usb/serial/option.c X-Git-Url: http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=commitdiff;h=5e8273250e73d3e2c4e67d0480dcb54e972f5023 [PATCH] USB: fix array overrun in drivers/usb/serial/option.c since the arrays are declared as in_urbs[N_IN_URB] and out_urbs[N_OUT_URB] both for loops, go one over the end of the array. This fixes coverity id #555 This patch was already included in Linus' tree. Signed-off-by: Eric Sesterhenn Signed-off-by: Adrian Bunk Signed-off-by: Greg Kroah-Hartman --- --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -582,14 +582,14 @@ static void option_setup_urbs(struct usb portdata = usb_get_serial_port_data(port); /* Do indat endpoints first */ - for (j = 0; j <= N_IN_URB; ++j) { + for (j = 0; j < N_IN_URB; ++j) { portdata->in_urbs[j] = option_setup_urb (serial, port->bulk_in_endpointAddress, USB_DIR_IN, port, portdata->in_buffer[j], IN_BUFLEN, option_indat_callback); } /* outdat endpoints */ - for (j = 0; j <= N_OUT_URB; ++j) { + for (j = 0; j < N_OUT_URB; ++j) { portdata->out_urbs[j] = option_setup_urb (serial, port->bulk_out_endpointAddress, USB_DIR_OUT, port, portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback);