Re: [PATCH] carminefb: beyond ARRAY_SIZE of carmine_modedb

Re: [PATCH] carminefb: beyond ARRAY_SIZE of carmine_modedb

[Andrew Morton]

On Wed, 20 May 2009 02:41:18 +0200 Roel Kluin <roel.kluin@gmail.com> wrote:

> CC: inux-fbdev-devel@lists.sourceforge.net, Andrew Morton <akpm@linux-foundation.org>

You mistyped the list address.

> Subject: [PATCH] carminefb: beyond ARRAY_SIZE of carmine_modedb
> Date: Wed, 20 May 2009 02:41:18 +0200
> User-Agent: Thunderbird 2.0.0.21 (X11/20090302)
> 
> Do not go beyond ARRAY_SIZE ofcarmine_modedb

Sort-of.  I changed the title and changelog:


Subject: carminefb: fix possible access beyond end of carmine_modedb[]
From: Roel Kluin <roel.kluin@gmail.com>

This check is off-by-one.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Cc: Sebastian Siewior <bigeasy@linutronix.de>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 drivers/video/carminefb.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff -puN drivers/video/carminefb.c~carminefb-beyond-array_size-of-carmine_modedb drivers/video/carminefb.c
--- a/drivers/video/carminefb.c~carminefb-beyond-array_size-of-carmine_modedb
+++ a/drivers/video/carminefb.c
@@ -562,7 +562,7 @@ static int __devinit alloc_carmine_fb(vo
 	if (ret < 0)
 		goto err_free_fb;
 
-	if (fb_mode > ARRAY_SIZE(carmine_modedb))
+	if (fb_mode >= ARRAY_SIZE(carmine_modedb))
 		fb_mode = CARMINEFB_DEFAULT_VIDEO_MODE;
 
 	par->cur_mode = par->new_mode = ~0;
_


------------------------------------------------------------------------------
Register Now for Creativity and Technology (CaT), June 3rd, NYC. CaT 
is a gathering of tech-side developers & brand creativity professionals. Meet
the minds behind Google Creative Lab, Visual Complexity, Processing, & 
iPhoneDevCamp as they present alongside digital heavyweights like Barbarian 
Group, R/GA, & Big Spaceship. http://p.sf.net/sfu/creativitycat-com