Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ef35a4f4 authored by Daeseok Youn's avatar Daeseok Youn Committed by Greg Kroah-Hartman
Browse files

staging: speakup: fix misuse of kstrtol() in handle_goto() 



A string of goto_buf has a number followed by x or y.
e.g. "3x" means move 3 lines down.
The kstrtol() returns an error(-EINVAL) with this string so
go_pos has unsigned a value of that error.
And also "*cp" has not expected value.

And fix sparse warnings:
 drivers/staging/speakup/main.c:1901 handle_goto() warn: unsigned '(speakup_console[vc->vc_num]->go_pos)' is never less than zero.
 drivers/staging/speakup/main.c:1911 handle_goto() warn: unsigned '(speakup_console[vc->vc_num]->go_pos)' is never less than zero.

Signed-off-by: default avatarDaeseok Youn <daeseok.youn@gmail.com>
Reviewed-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ff8ebe64

drivers/staging/speakup/main.c

+9 −9
Original line number Diff line number Diff line
@@ -1855,8 +1855,9 @@ static int handle_goto(struct vc_data *vc, u_char type, u_char ch, u_short key) 
{

	static u_char goto_buf[8];

	static int num;

	int maxlen, go_pos;

	int maxlen;

	char *cp;



	if (type == KT_SPKUP && ch == SPEAKUP_GOTO)

		goto do_goto;

	if (type == KT_LATIN && ch == '\n')
@@ -1891,25 +1892,24 @@ oops: 
		spk_special_handler = NULL;

		return 1;

	}

	go_pos = kstrtol(goto_buf, 10, (long *)&cp);

	goto_pos = (u_long) go_pos;



	goto_pos = simple_strtoul(goto_buf, &cp, 10);



	if (*cp == 'x') {

		if (*goto_buf < '0')

			goto_pos += spk_x;

		else

		else if (goto_pos > 0)

			goto_pos--;

		if (goto_pos < 0)

			goto_pos = 0;



		if (goto_pos >= vc->vc_cols)

			goto_pos = vc->vc_cols - 1;

		goto_x = 1;

	} else {

		if (*goto_buf < '0')

			goto_pos += spk_y;

		else

		else if (goto_pos > 0)

			goto_pos--;

		if (goto_pos < 0)

			goto_pos = 0;



		if (goto_pos >= vc->vc_rows)

			goto_pos = vc->vc_rows - 1;

		goto_x = 0;