diff options
| author | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2015-07-30 11:01:13 -0700 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2015-08-03 14:11:45 -0700 |
| commit | c20bc5502d151ca731ebc672b95aa77e2bf32c8c (patch) | |
| tree | 0cfbf09be90866e7d1988227987b43dbbab53985 /drivers/input | |
| parent | 3213afb8bf5cf8d8c68a2c2376bf1dda52afae5d (diff) | |
| download | linux-c20bc5502d151ca731ebc672b95aa77e2bf32c8c.tar.gz linux-c20bc5502d151ca731ebc672b95aa77e2bf32c8c.tar.bz2 linux-c20bc5502d151ca731ebc672b95aa77e2bf32c8c.zip | |
Input: turbografx - fix potential out of bound access
Patch 17dd3f0f7aa7: "[PATCH] drivers/input/joystick: convert to dynamic
input_dev allocation" from Sep 15, 2005, leads to the following static
checker warning:
drivers/input/joystick/turbografx.c:235 tgfx_probe()
error: buffer overflow 'tgfx_buttons' 5 <= 5
drivers/input/joystick/turbografx.c
195 for (i = 0; i < n_devs; i++) {
196 if (n_buttons[i] < 1)
197 continue;
198
199 if (n_buttons[i] > 6) {
^^^^^^^^^^^^^^^^
Possibly off by one. >= 6.
Let's change the upper value to ARRAY_SIZE(tgfx_buttons) to ensure we do
not reach past the end of the array.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Diffstat (limited to 'drivers/input')
| -rw-r--r-- | drivers/input/joystick/turbografx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/input/joystick/turbografx.c b/drivers/input/joystick/turbografx.c index 27b6a3ce18ca..891797ad76bc 100644 --- a/drivers/input/joystick/turbografx.c +++ b/drivers/input/joystick/turbografx.c @@ -196,7 +196,7 @@ static struct tgfx __init *tgfx_probe(int parport, int *n_buttons, int n_devs) if (n_buttons[i] < 1) continue; - if (n_buttons[i] > 6) { + if (n_buttons[i] > ARRAY_SIZE(tgfx_buttons)) { printk(KERN_ERR "turbografx.c: Invalid number of buttons %d\n", n_buttons[i]); err = -EINVAL; goto err_unreg_devs; |