[PATCH] libata: Read buffer overflow

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Check whether index is within bounds before grabbing the element.

Signed-off-by: Roel Kluin <roel.kluin@xxxxxxxxx>
---
diff --git a/drivers/ata/pata_mpc52xx.c b/drivers/ata/pata_mpc52xx.c
index 2bc2dbe..f88c2ff 100644
--- a/drivers/ata/pata_mpc52xx.c
+++ b/drivers/ata/pata_mpc52xx.c
@@ -294,10 +294,11 @@ mpc52xx_ata_compute_mdma_timings(struct mpc52xx_ata_priv *priv, int dev,
 				 int speed)
 {
 	struct mpc52xx_ata_timings *t = &priv->timings[dev];
-	const struct mdmaspec *s = &priv->mdmaspec[speed];
+	const struct mdmaspec *s;
 
 	if (speed < 0 || speed > 2)
 		return -EINVAL;
+	s = &priv->mdmaspec[speed];
 
 	t->mdma1 = (s->t0M << 24) | (s->td << 16) | (s->tkw << 8) | (s->tm);
 	t->mdma2 = (s->th << 24) | (s->tj << 16) | (s->tn << 8);
@@ -311,10 +312,11 @@ mpc52xx_ata_compute_udma_timings(struct mpc52xx_ata_priv *priv, int dev,
 				 int speed)
 {
 	struct mpc52xx_ata_timings *t = &priv->timings[dev];
-	const struct udmaspec *s = &priv->udmaspec[speed];
+	const struct udmaspec *s;
 
 	if (speed < 0 || speed > 2)
 		return -EINVAL;
+	s = &priv->udmaspec[speed];
 
 	t->udma1 = (s->t2cyc << 24) | (s->tcyc << 16) | (s->tds << 8) | s->tdh;
 	t->udma2 = (s->tdvs << 24) | (s->tdvh << 16) | (s->tfs << 8) | s->tli;
--
To unsubscribe from this list: send the line "unsubscribe linux-ide" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Filesystems]     [Linux SCSI]     [Linux RAID]     [Git]     [Kernel Newbies]     [Linux Newbie]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Samba]     [Device Mapper]

  Powered by Linux