diff options
| author | Jiri Kosina <jkosina@suse.cz> | 2013-01-31 16:51:47 +0100 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.cz> | 2013-01-31 16:51:47 +0100 |
| commit | 7e41576247b782a21c05f7ea8a78a6db119ba789 (patch) | |
| tree | ae913df79a900dc357f6ffe6855d62feabde8bdb | |
| parent | 090800c2a3f746572ef142e2d5404922a599e841 (diff) | |
| download | op-kernel-dev-7e41576247b782a21c05f7ea8a78a6db119ba789.zip op-kernel-dev-7e41576247b782a21c05f7ea8a78a6db119ba789.tar.gz | |
HID: steelseries: fix out of bound array access
The last field of the driver_data->leds[] array is used to store the
special toggle for setting all leds simultaneously, so we need to allocate
appropriate number of led_classdev pointers.
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| -rw-r--r-- | drivers/hid/hid-steelseries.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c index 365bc9e..2ed995c 100644 --- a/drivers/hid/hid-steelseries.c +++ b/drivers/hid/hid-steelseries.c @@ -23,7 +23,8 @@ #define SRWS1_NUMBER_LEDS 15 struct steelseries_srws1_data { __u16 led_state; - struct led_classdev *led[SRWS1_NUMBER_LEDS]; + /* the last element is used for setting all leds simultaneously */ + struct led_classdev *led[SRWS1_NUMBER_LEDS + 1]; }; #endif |
