Re: [patch 001/001] input: fix read past array bounds

[walter harms <wharms@bfs.de>]

nice catch,
just to improve readablility .... and reduce the change of an other error ...



 if (keycode < ARRAY_SIZE(key_map) )	
	keysym = key_map[keycode];
 else {
	      if (keycode >= KEY_BRL_DOT1 && keycode <= KEY_BRL_DOT8)
                        keysym = K(KT_BRL, keycode - KEY_BRL_DOT1 + 1);
               else
                       return;
	}



re,
 wh

Michal Roszkowski schrieb:
> 
> ---
> 
> Trivial fix for read past end of key_map[] when keycode = NR_KEYS.
> 
> --- linux-2.6.26.5/drivers/char/keyboard.c.orig    2008-10-05
> 15:51:09.000000000 +1030
> +++ linux-2.6.26.5/drivers/char/keyboard.c    2008-10-05
> 15:52:17.000000000 +1030
> @@ -1247,7 +1247,7 @@ static void kbd_keycode(unsigned int key
>         return;
>     }
> 
> -    if (keycode > NR_KEYS)
> +    if (keycode >= NR_KEYS)
>         if (keycode >= KEY_BRL_DOT1 && keycode <= KEY_BRL_DOT8)
>             keysym = K(KT_BRL, keycode - KEY_BRL_DOT1 + 1);
>         else
> 
> -- 
> To unsubscribe from this list: send the line "unsubscribe
> kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
> 
>