Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 84ea7763 authored by Eric Sesterhenn / Snakebyte's avatar Eric Sesterhenn / Snakebyte Committed by Linus Torvalds
Browse files

Overrun in drivers/char/rio/riocmd.c 



This got somehow lost in the noise.  This fixes coverity bug id #1025, if
Rup is greater or equal to MAX_RUP, we run past the Mapping Array.

Signed-off-by: default avatarEric Sesterhenn <snakebyte@gmx.de>
Cc: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent a12bb444

drivers/char/rio/riocmd.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -402,7 +402,7 @@ static int RIOCommandRup(struct rio_info *p, uint Rup, struct Host *HostP, struc 
		rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: Host number %Zd, name ``%s''\n", HostP - p->RIOHosts, HostP->Name);

		rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: Host number %Zd, name ``%s''\n", HostP - p->RIOHosts, HostP->Name);

		rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: Rup number  0x%x\n", rup);

		rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: Rup number  0x%x\n", rup);





		if (Rup >= (unsigned short) MAX_RUP) {

		if (Rup < (unsigned short) MAX_RUP) {

			rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: This is the RUP for RTA ``%s''\n", HostP->Mapping[Rup].Name);

			rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: This is the RUP for RTA ``%s''\n", HostP->Mapping[Rup].Name);

		} else

		} else

			rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: This is the RUP for link ``%c'' of host ``%s''\n", ('A' + Rup - MAX_RUP), HostP->Name);

			rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: This is the RUP for link ``%c'' of host ``%s''\n", ('A' + Rup - MAX_RUP), HostP->Name);