mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-04 16:15:11 +00:00
Code Issues Releases Wiki Activity

staging: speakup: ensure we do not overrun synths array

Browse source 
synth_add allows one to add MAXSYNTHS synths to the synths array;
however it always NULLifies the next synth in the array which
means that on the MAXSYNTHS synth we get an out-of-bounds write of
the NULL to the synths array.  Make the synths array MAXSYNTHS + 1
elements in size to allow for the final NULL sentinal to avoid the
out-of-bounds write.

Issue found wit CoverityScan, CID#744671

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Colin Ian King 2016-05-09 23:22:14 +01:00 committed by Greg Kroah-Hartman
parent b6ed5a233a
commit 99a9ffacc1
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/staging/speakup/synth.c
View file

@ -18,7 +18,7 @@
#include "serialio.h"
#define MAXSYNTHS 16 /* Max number of synths in array. */
static struct spk_synth *synths[MAXSYNTHS];
static struct spk_synth *synths[MAXSYNTHS + 1];
struct spk_synth *synth;
char spk_pitch_buff[32] = "";
static int module_status;