TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[PATCH] USB: fix array overrun in drivers/usb/serial/option.c

Browse Source 
since the arrays are declared as in_urbs[N_IN_URB]
and out_urbs[N_OUT_URB] both for loops, go one
over the end of the array. This fixes coverity id #555

This patch was already included in Linus' tree.

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Eric Sesterhenn
2006-04-23 22:52:28 +02:00
committed by Greg Kroah-Hartman
parent c89ce82c2d
commit 5e8273250e
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/usb/serial/option.c
+2 -2
View File
@@ -582,14 +582,14 @@ static void option_setup_urbs(struct usb_serial *serial)
portdata = usb_get_serial_port_data(port);
/* Do indat endpoints first */
for (j = 0; j <= N_IN_URB; ++j) {
for (j = 0; j < N_IN_URB; ++j) {
portdata->in_urbs[j] = option_setup_urb (serial,
port->bulk_in_endpointAddress, USB_DIR_IN, port,
portdata->in_buffer[j], IN_BUFLEN, option_indat_callback);
}
/* outdat endpoints */
for (j = 0; j <= N_OUT_URB; ++j) {
for (j = 0; j < N_OUT_URB; ++j) {
portdata->out_urbs[j] = option_setup_urb (serial,
port->bulk_out_endpointAddress, USB_DIR_OUT, port,
portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback);