diff options
| author | Florin Malita <fmalita@gmail.com> | 2006-08-23 00:45:33 -0400 |
|---|---|---|
| committer | Dmitry Torokhov <dtor@insightbb.com> | 2006-08-23 00:45:33 -0400 |
| commit | 8ea371fb6df5a6e8056265e0089fd578e87797fc (patch) | |
| tree | 4c3686a5c6ef6e386ad25998c98873ddc73ff709 | |
| parent | 2ffc1ccad85e8c2e81a6a4beb390fb4ce143256b (diff) | |
| download | op-kernel-dev-8ea371fb6df5a6e8056265e0089fd578e87797fc.zip op-kernel-dev-8ea371fb6df5a6e8056265e0089fd578e87797fc.tar.gz | |
Input: atkbd - fix overrun in atkbd_set_repeat_rate()
This was introduced in commit 3d0f0fa0cb554541e10cb8cb84104e4b10828468:
bounds checking is performed against period[32] while indexing delay[4].
Spotted by Coverity, CID 1376.
Signed-off-by: Florin Malita <fmalita@gmail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
| -rw-r--r-- | drivers/input/keyboard/atkbd.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c index 6bfa0cf..a86afd0 100644 --- a/drivers/input/keyboard/atkbd.c +++ b/drivers/input/keyboard/atkbd.c @@ -498,7 +498,7 @@ static int atkbd_set_repeat_rate(struct atkbd *atkbd) i++; dev->rep[REP_PERIOD] = period[i]; - while (j < ARRAY_SIZE(period) - 1 && delay[j] < dev->rep[REP_DELAY]) + while (j < ARRAY_SIZE(delay) - 1 && delay[j] < dev->rep[REP_DELAY]) j++; dev->rep[REP_DELAY] = delay[j]; |
