mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-19 17:11:03 +00:00
Code Issues Releases Wiki Activity

Staging: ft1000-usb: fix array overflow

Browse source 
The code here is supposed checking if we exited the loop without hitting
a break.  The problem is that in the error handling "i" is out of bounds
and it corrupts memory when we do an info->app_info[i].nRxMsgMiss++.
>From the comments, it looks like someone noticed this corruption and
updated the code, but didn't totally fix the problem.  The correct fix
is just to remove nRxMsgMiss++ from the error path.

I believe this bug can be triggered remotely.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Dan Carpenter 2010-10-15 05:42:00 +02:00 committed by Greg Kroah-Hartman
parent 4073f1b6ab
commit fcbf77bf87
1 changed files with 1 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
drivers/staging/ft1000/ft1000-usb/ft1000_hw.c
View file

@ -2615,8 +2615,7 @@ int ft1000_poll(void* dev_id) {
}
}
if (i==(MAX_NUM_APP-1)) { // aelias [+] reason: was out of array boundary
info->app_info[i].nRxMsgMiss++;
if (i == MAX_NUM_APP) {
DEBUG("FT1000:ft1000_parse_dpram_msg: No application matching id = %d\n", ppseudo_hdr->portdest);
// Put memory back to free pool
ft1000_free_buffer(pdpram_blk, &freercvpool);