[PATCH] staging: speakup: fix misuse of kstrtol() in handle_goto()

[PATCH] staging: speakup: fix misuse of kstrtol() in handle_goto()

[Daeseok Youn]

A string of goto_buf has a number followed by x or y.
e.g. "3x" means move 3 lines down.
The kstrtol() returns an error(-EINVAL) with this string so
go_pos has unsigned a value of that error.
And also "*cp" has not expected value.

And fix sparse warnings:
 drivers/staging/speakup/main.c:1901 handle_goto() warn:
unsigned '(speakup_console[vc->vc_num]->go_pos)' is never less than zero.
 drivers/staging/speakup/main.c:1911 handle_goto() warn:
unsigned '(speakup_console[vc->vc_num]->go_pos)' is never less than zero.

Signed-off-by: Daeseok Youn <daeseok.youn@gmail.com>
---
 drivers/staging/speakup/main.c |   18 +++++++++---------
 1 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c
index ef5933b..3b6e535 100644
--- a/drivers/staging/speakup/main.c
+++ b/drivers/staging/speakup/main.c
@@ -1855,8 +1855,9 @@ static int handle_goto(struct vc_data *vc, u_char type, u_char ch, u_short key)
 {
 	static u_char goto_buf[8];
 	static int num;
-	int maxlen, go_pos;
+	int maxlen;
 	char *cp;
+
 	if (type == KT_SPKUP && ch == SPEAKUP_GOTO)
 		goto do_goto;
 	if (type == KT_LATIN && ch == '\n')
@@ -1891,25 +1892,24 @@ oops:
 		spk_special_handler = NULL;
 		return 1;
 	}
-	go_pos = kstrtol(goto_buf, 10, (long *)&cp);
-	goto_pos = (u_long) go_pos;
+
+	goto_pos = simple_strtoul(goto_buf, &cp, 10);
+
 	if (*cp == 'x') {
 		if (*goto_buf < '0')
 			goto_pos += spk_x;
-		else
+		else if (goto_pos > 0)
 			goto_pos--;
-		if (goto_pos < 0)
-			goto_pos = 0;
+
 		if (goto_pos >= vc->vc_cols)
 			goto_pos = vc->vc_cols - 1;
 		goto_x = 1;
 	} else {
 		if (*goto_buf < '0')
 			goto_pos += spk_y;
-		else
+		else if (goto_pos > 0)
 			goto_pos--;
-		if (goto_pos < 0)
-			goto_pos = 0;
+
 		if (goto_pos >= vc->vc_rows)
 			goto_pos = vc->vc_rows - 1;
 		goto_x = 0;
-- 
1.7.4.4

Re: [PATCH] staging: speakup: fix misuse of kstrtol() in handle_goto()

[Dan Carpenter]

On Wed, Apr 09, 2014 at 07:45:46PM +0900, Daeseok Youn wrote:
> 
> A string of goto_buf has a number followed by x or y.
> e.g. "3x" means move 3 lines down.
> The kstrtol() returns an error(-EINVAL) with this string so
> go_pos has unsigned a value of that error.
> And also "*cp" has not expected value.
> 

Good catch.  This was introduced when we changed the simple_strtoul() to
kstrtol().

Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>

Did you find this bug by testing or through reading the code?

regards,
dan carpenter

Re: [PATCH] staging: speakup: fix misuse of kstrtol() in handle_goto()

[DaeSeok Youn]

2014-04-09 20:39 GMT+09:00, Dan Carpenter <dan.carpenter@oracle.com>:
> On Wed, Apr 09, 2014 at 07:45:46PM +0900, Daeseok Youn wrote:
>>
>> A string of goto_buf has a number followed by x or y.
>> e.g. "3x" means move 3 lines down.
>> The kstrtol() returns an error(-EINVAL) with this string so
>> go_pos has unsigned a value of that error.
>> And also "*cp" has not expected value.
>>
>
> Good catch.  This was introduced when we changed the simple_strtoul() to
> kstrtol().

Thanks! :-)

>
> Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> Did you find this bug by testing or through reading the code?
Actually, I couldn't test. I have looked the code for checking sparse
warnings and found this bug.

Regards,
Daeseok Youn

>
> regards,
> dan carpenter
>
>