diff options
| author | Matthias Urlichs <smurf@smurf.noris.de> | 2006-04-11 05:01:44 +0200 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-04-11 06:24:15 -0700 |
| commit | 6dde432553551ae036aae12c2b940677d36c9a5b (patch) | |
| tree | 2998fe9a1f6517717a7433f2fcf318b176fc1492 | |
| parent | 397eeab321e87d8c1ef928b58f256513e6f481dc (diff) | |
| download | op-kernel-dev-6dde432553551ae036aae12c2b940677d36c9a5b.zip op-kernel-dev-6dde432553551ae036aae12c2b940677d36c9a5b.tar.gz | |
[PATCH] Overrun in option-card USB driver
Since the arrays are declared as in_urbs[N_IN_URB]
and out_urbs[N_OUT_URB], both for loops go one
over the end of the array. This fixes coverity id #555.
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-Off-By: Matthias Urlichs <smurf@smurf.noris.de>
Signed-Off-By: Linus Torvalds <torvalds@osdl.org>
| -rw-r--r-- | drivers/usb/serial/option.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c index 495db57..5cf2b80 100644 --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -28,6 +28,7 @@ 2005-09-10 v0.4.3 added HUAWEI E600 card and Audiovox AirCard 2005-09-20 v0.4.4 increased recv buffer size: the card sometimes wants to send >2000 bytes. + 2006-04-10 v0.4.2 fixed two array overrun errors :-/ Work sponsored by: Sigos GmbH, Germany <info@sigos.de> @@ -582,14 +583,14 @@ static void option_setup_urbs(struct usb_serial *serial) portdata = usb_get_serial_port_data(port); /* Do indat endpoints first */ - for (j = 0; j <= N_IN_URB; ++j) { + for (j = 0; j < N_IN_URB; ++j) { portdata->in_urbs[j] = option_setup_urb (serial, port->bulk_in_endpointAddress, USB_DIR_IN, port, portdata->in_buffer[j], IN_BUFLEN, option_indat_callback); } /* outdat endpoints */ - for (j = 0; j <= N_OUT_URB; ++j) { + for (j = 0; j < N_OUT_URB; ++j) { portdata->out_urbs[j] = option_setup_urb (serial, port->bulk_out_endpointAddress, USB_DIR_OUT, port, portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback); |
