linux-mips
[Top] [All Lists]

[patch] [MIPS] Lasat: a couple off by one bugs in picvue_proc.c

To: Ralf Baechle <ralf@linux-mips.org>
Subject: [patch] [MIPS] Lasat: a couple off by one bugs in picvue_proc.c
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 8 Nov 2013 12:44:31 +0300
Cc: linux-mips@linux-mips.org, kernel-janitors@vger.kernel.org
List-archive: <http://www.linux-mips.org/archives/linux-mips/>
List-help: <mailto:ecartis@linux-mips.org?Subject=help>
List-id: linux-mips <linux-mips.eddie.linux-mips.org>
List-owner: <mailto:ralf@linux-mips.org>
List-post: <mailto:linux-mips@linux-mips.org>
List-software: Ecartis version 1.0.0
List-subscribe: <mailto:ecartis@linux-mips.org?subject=subscribe%20linux-mips>
List-unsubscribe: <mailto:ecartis@linux-mips.org?subject=unsubscribe%20linux-mips>
Original-recipient: rfc822;linux-mips@linux-mips.org
Sender: linux-mips-bounce@linux-mips.org
User-agent: Mutt/1.5.21 (2010-09-15)
These should be ">=" instead of ">" or we go past the end of the
pvc_lines[] array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/arch/mips/lasat/picvue_proc.c b/arch/mips/lasat/picvue_proc.c
index 638c5db..8c55de4 100644
--- a/arch/mips/lasat/picvue_proc.c
+++ b/arch/mips/lasat/picvue_proc.c
@@ -44,7 +44,7 @@ static int pvc_line_proc_show(struct seq_file *m, void *v)
 {
        int lineno = *(int *)m->private;
 
-       if (lineno < 0 || lineno > PVC_NLINES) {
+       if (lineno < 0 || lineno >= PVC_NLINES) {
                printk(KERN_WARNING "proc_read_line: invalid lineno %d\n", 
lineno);
                return 0;
        }
@@ -68,7 +68,7 @@ static ssize_t pvc_line_proc_write(struct file *file, const 
char __user *buf,
        char kbuf[PVC_LINELEN];
        size_t len;
 
-       BUG_ON(lineno < 0 || lineno > PVC_NLINES);
+       BUG_ON(lineno < 0 || lineno >= PVC_NLINES);
 
        len = min(count, sizeof(kbuf) - 1);
        if (copy_from_user(kbuf, buf, len))

<Prev in Thread] Current Thread [Next in Thread>
  • [patch] [MIPS] Lasat: a couple off by one bugs in picvue_proc.c, Dan Carpenter <=