rtc-ds1307.c: array overrun

rtc-ds1307.c: array overrun

[Adrian Bunk]

The Coverity checker spotted the following array overrun
in drivers/rtc/rtc-ds1307.c:

<--  snip  -->

...
#define DS1337_REG_CONTROL      0x0e
...
struct ds1307 {
        u8                      reg_addr;
        u8                      regs[8];
...
};
...
static int __devinit ds1307_probe(struct i2c_client *client)
{
...
                                        ds1307->regs[DS1337_REG_CONTROL]
...

<--  snip  -->


0x0e > 8


cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Re: rtc-ds1307.c: array overrun

[David Brownell]

On Sunday 22 July 2007, Adrian Bunk wrote:
> The Coverity checker spotted the following array overrun
> in drivers/rtc/rtc-ds1307.c:

Typo -- thanks, fix is attached.

========	CUT HERE
Fix a typo turned up by a Coverity check:  referring to the wrong register,
which could cause problems restarting DS1338 RTCs after their oscillator
halted.  (For example, if the backup battery died.)

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
---
 drivers/rtc/rtc-ds1307.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- g26.orig/drivers/rtc/rtc-ds1307.c	2007-07-22 18:10:09.000000000 -0700
+++ g26/drivers/rtc/rtc-ds1307.c	2007-07-22 18:10:21.000000000 -0700
@@ -352,7 +352,7 @@ read_rtc:
 		/* oscillator fault?  clear flag, and warn */
 		if (ds1307->regs[DS1307_REG_CONTROL] & DS1338_BIT_OSF) {
 			i2c_smbus_write_byte_data(client, DS1307_REG_CONTROL,
-					ds1307->regs[DS1337_REG_CONTROL]
+					ds1307->regs[DS1307_REG_CONTROL]
 					& ~DS1338_BIT_OSF);
 			dev_warn(&client->dev, "SET TIME!\n");
 			goto read_rtc;

Re: [rtc-linux] Re: rtc-ds1307.c: array overrun

[Alessandro Zummo]

On Sun, 22 Jul 2007 18:17:17 -0700
David Brownell <david-b@pacbell.net> wrote:

> 
> On Sunday 22 July 2007, Adrian Bunk wrote:
> > The Coverity checker spotted the following array overrun
> > in drivers/rtc/rtc-ds1307.c:
> 
> Typo -- thanks, fix is attached.
> 
> ========	CUT HERE
> Fix a typo turned up by a Coverity check:  referring to the wrong register,
> which could cause problems restarting DS1338 RTCs after their oscillator
> halted.  (For example, if the backup battery died.)
> 
> Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

 
 Acked-by: Alessandro Zummo <a.zummo@towertech.it>

-- 

 Best regards,

 Alessandro Zummo,
  Tower Technologies - Torino, Italy

  http://www.towertech.it