Commit 6dde4325 authored by Matthias Urlichs's avatar Matthias Urlichs Committed by Linus Torvalds

[PATCH] Overrun in option-card USB driver

Since the arrays are declared as in_urbs[N_IN_URB]
and out_urbs[N_OUT_URB], both for loops go one
over the end of the array. This fixes coverity id #555.
Signed-off-by: default avatarEric Sesterhenn <snakebyte@gmx.de>
Signed-Off-By: default avatarMatthias Urlichs <smurf@smurf.noris.de>
Signed-Off-By: default avatarLinus Torvalds <torvalds@osdl.org>
parent 397eeab3
...@@ -28,6 +28,7 @@ ...@@ -28,6 +28,7 @@
2005-09-10 v0.4.3 added HUAWEI E600 card and Audiovox AirCard 2005-09-10 v0.4.3 added HUAWEI E600 card and Audiovox AirCard
2005-09-20 v0.4.4 increased recv buffer size: the card sometimes 2005-09-20 v0.4.4 increased recv buffer size: the card sometimes
wants to send >2000 bytes. wants to send >2000 bytes.
2006-04-10 v0.4.2 fixed two array overrun errors :-/
Work sponsored by: Sigos GmbH, Germany <info@sigos.de> Work sponsored by: Sigos GmbH, Germany <info@sigos.de>
...@@ -582,14 +583,14 @@ static void option_setup_urbs(struct usb_serial *serial) ...@@ -582,14 +583,14 @@ static void option_setup_urbs(struct usb_serial *serial)
portdata = usb_get_serial_port_data(port); portdata = usb_get_serial_port_data(port);
/* Do indat endpoints first */ /* Do indat endpoints first */
for (j = 0; j <= N_IN_URB; ++j) { for (j = 0; j < N_IN_URB; ++j) {
portdata->in_urbs[j] = option_setup_urb (serial, portdata->in_urbs[j] = option_setup_urb (serial,
port->bulk_in_endpointAddress, USB_DIR_IN, port, port->bulk_in_endpointAddress, USB_DIR_IN, port,
portdata->in_buffer[j], IN_BUFLEN, option_indat_callback); portdata->in_buffer[j], IN_BUFLEN, option_indat_callback);
} }
/* outdat endpoints */ /* outdat endpoints */
for (j = 0; j <= N_OUT_URB; ++j) { for (j = 0; j < N_OUT_URB; ++j) {
portdata->out_urbs[j] = option_setup_urb (serial, portdata->out_urbs[j] = option_setup_urb (serial,
port->bulk_out_endpointAddress, USB_DIR_OUT, port, port->bulk_out_endpointAddress, USB_DIR_OUT, port,
portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback); portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment