]> git.karo-electronics.de Git - mv-sheeva.git/commit
Staging: ft1000-usb: fix array overflow
authorDan Carpenter <error27@gmail.com>
Fri, 15 Oct 2010 03:42:00 +0000 (05:42 +0200)
committerGreg Kroah-Hartman <gregkh@suse.de>
Fri, 15 Oct 2010 19:24:38 +0000 (12:24 -0700)
commitfcbf77bf872c28ac3f18261a44af91383f0a2f3d
tree2fc58c37a0684b142b9758e4457f40dcdfc0c607
parent4073f1b6ab9c70d603b194b1bb415b9e742b245f
Staging: ft1000-usb: fix array overflow

The code here is supposed checking if we exited the loop without hitting
a break.  The problem is that in the error handling "i" is out of bounds
and it corrupts memory when we do an info->app_info[i].nRxMsgMiss++.
>From the comments, it looks like someone noticed this corruption and
updated the code, but didn't totally fix the problem.  The correct fix
is just to remove nRxMsgMiss++ from the error path.

I believe this bug can be triggered remotely.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/staging/ft1000/ft1000-usb/ft1000_hw.c