* [PATCH] atkbd.c: overrun in atkbd_set_repeat_rate()
@ 2006-08-13 21:10 Florin Malita
2006-08-13 23:50 ` Dmitry Torokhov
0 siblings, 1 reply; 2+ messages in thread
From: Florin Malita @ 2006-08-13 21:10 UTC (permalink / raw)
To: dmitry.torokhov; +Cc: linux-kernel, akpm
This was introduced in commit 3d0f0fa0cb554541e10cb8cb84104e4b10828468:
bounds checking is performed against period[32] while indexing delay[4].
Spotted by Coverity, CID 1376.
Signed-off-by: Florin Malita <fmalita@gmail.com>
---
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 6bfa0cf..a86afd0 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -498,7 +498,7 @@ static int atkbd_set_repeat_rate(struct
i++;
dev->rep[REP_PERIOD] = period[i];
- while (j < ARRAY_SIZE(period) - 1 && delay[j] < dev->rep[REP_DELAY])
+ while (j < ARRAY_SIZE(delay) - 1 && delay[j] < dev->rep[REP_DELAY])
j++;
dev->rep[REP_DELAY] = delay[j];
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] atkbd.c: overrun in atkbd_set_repeat_rate()
2006-08-13 21:10 [PATCH] atkbd.c: overrun in atkbd_set_repeat_rate() Florin Malita
@ 2006-08-13 23:50 ` Dmitry Torokhov
0 siblings, 0 replies; 2+ messages in thread
From: Dmitry Torokhov @ 2006-08-13 23:50 UTC (permalink / raw)
To: Florin Malita; +Cc: linux-kernel, akpm
On Sunday 13 August 2006 17:10, Florin Malita wrote:
> This was introduced in commit 3d0f0fa0cb554541e10cb8cb84104e4b10828468:
> bounds checking is performed against period[32] while indexing delay[4].
>
> Spotted by Coverity, CID 1376.
>
Will apply, thank you.
> Signed-off-by: Florin Malita <fmalita@gmail.com>
> ---
>
> diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
> index 6bfa0cf..a86afd0 100644
> --- a/drivers/input/keyboard/atkbd.c
> +++ b/drivers/input/keyboard/atkbd.c
> @@ -498,7 +498,7 @@ static int atkbd_set_repeat_rate(struct
> i++;
> dev->rep[REP_PERIOD] = period[i];
>
> - while (j < ARRAY_SIZE(period) - 1 && delay[j] < dev->rep[REP_DELAY])
> + while (j < ARRAY_SIZE(delay) - 1 && delay[j] < dev->rep[REP_DELAY])
> j++;
> dev->rep[REP_DELAY] = delay[j];
>
>
>
--
Dmitry
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2006-08-13 23:50 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-08-13 21:10 [PATCH] atkbd.c: overrun in atkbd_set_repeat_rate() Florin Malita
2006-08-13 23:50 ` Dmitry Torokhov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox