Colin King, on Mon 09 May 2016 23:22:14 +0100, wrote: > From: Colin Ian King <colin.king@xxxxxxxxxxxxx> > > synth_add allows one to add MAXSYNTHS synths to the synths array; > however it always NULLifies the next synth in the array which > means that on the MAXSYNTHS synth we get an out-of-bounds write of > the NULL to the synths array. Make the synths array MAXSYNTHS + 1 > elements in size to allow for the final NULL sentinal to avoid the > out-of-bounds write. > > Issue found wit CoverityScan, CID#744671 > > Signed-off-by: Colin Ian King <colin.king@xxxxxxxxxxxxx> Reviewed-by: Samuel Thibault <samuel.thibault@xxxxxxxxxxxx> > --- > drivers/staging/speakup/synth.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/staging/speakup/synth.c b/drivers/staging/speakup/synth.c > index 4f462c3..810a214 100644 > --- a/drivers/staging/speakup/synth.c > +++ b/drivers/staging/speakup/synth.c > @@ -18,7 +18,7 @@ > #include "serialio.h" > > #define MAXSYNTHS 16 /* Max number of synths in array. */ > -static struct spk_synth *synths[MAXSYNTHS]; > +static struct spk_synth *synths[MAXSYNTHS + 1]; > struct spk_synth *synth; > char spk_pitch_buff[32] = ""; > static int module_status; > -- > 2.8.1 > -- Samuel Actually, typing random strings in the Finder does the equivalent of filename completion. (Discussion in comp.os.linux.misc on the intuitiveness of commands: file completion vs. the Mac Finder.) _______________________________________________ Speakup mailing list Speakup@xxxxxxxxxxxxxxxxx http://linux-speakup.org/cgi-bin/mailman/listinfo/speakup
