[PATCH] Staging: speakup: fix an out-of-bounds error.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



The cur_item variable from keyhelp.c is an index into a table of
messages.  The following condition should always hold:
MSG_FUNCNAMES_START + cur_item <= MSG_FUNCNAMES_END.
The check in keyhelp.c was wrong.  It allowed cur_item to be
incremented to an out-of-bounds value.

Signed-off-by: Christopher Brannon <chris@xxxxxxxxxxxxxxxx>
---
 drivers/staging/speakup/keyhelp.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/drivers/staging/speakup/keyhelp.c b/drivers/staging/speakup/keyhelp.c
index 236f06d..23cf7f4 100644
--- a/drivers/staging/speakup/keyhelp.c
+++ b/drivers/staging/speakup/keyhelp.c
@@ -161,7 +161,9 @@ int handle_help(struct vc_data *vc, u_char type, u_char ch, u_short key)
 		}
 	cur_item = letter_offsets[ch-'a'];
 	} else if (type == KT_CUR) {
-		if (ch == 0 && (cur_item + 1) <= MSG_FUNCNAMES_END)
+		if (ch == 0
+		    && (MSG_FUNCNAMES_START + cur_item + 1) <=
+		    MSG_FUNCNAMES_END)
 			cur_item++;
 		else if (ch == 3 && cur_item > 0)
 			cur_item--;
-- 
1.7.3.4

_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/devel


[Index of Archives]     [Linux Driver Backports]     [DMA Engine]     [Linux GPIO]     [Linux SPI]     [Video for Linux]     [Linux USB Devel]     [Linux Coverity]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux