From: Colin Ian King <colin.king@xxxxxxxxxxxxx> synth_add allows one to add MAXSYNTHS synths to the synths array; however it always NULLifies the next synth in the array which means that on the MAXSYNTHS synth we get an out-of-bounds write of the NULL to the synths array. Make the synths array MAXSYNTHS + 1 elements in size to allow for the final NULL sentinal to avoid the out-of-bounds write. Issue found wit CoverityScan, CID#744671 Signed-off-by: Colin Ian King <colin.king@xxxxxxxxxxxxx> --- drivers/staging/speakup/synth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/speakup/synth.c b/drivers/staging/speakup/synth.c index 4f462c3..810a214 100644 --- a/drivers/staging/speakup/synth.c +++ b/drivers/staging/speakup/synth.c @@ -18,7 +18,7 @@ #include "serialio.h" #define MAXSYNTHS 16 /* Max number of synths in array. */ -static struct spk_synth *synths[MAXSYNTHS]; +static struct spk_synth *synths[MAXSYNTHS + 1]; struct spk_synth *synth; char spk_pitch_buff[32] = ""; static int module_status; -- 2.8.1 _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
