[patch] applicom: use correct array offset

[patch] applicom: use correct array offset

[Dan Carpenter]

We're iterating through abps[] printing information, but here we
use the wrong array index.  IndexCard comes from the user and in
this case it was specifically not range checked because we didn't
expect to use it.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
index 25373df..974321a 100644
--- a/drivers/char/applicom.c
+++ b/drivers/char/applicom.c
@@ -804,8 +804,8 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
 			printk(KERN_INFO "Prom version board %d ....... V%d.%d %s",
 			       i+1,
-			       (int)(readb(apbs[IndexCard].RamIO + VERS) >> 4),
-			       (int)(readb(apbs[IndexCard].RamIO + VERS) & 0xF),
+			       (int)(readb(apbs[i].RamIO + VERS) >> 4),
+			       (int)(readb(apbs[i].RamIO + VERS) & 0xF),
 			       boardname);
 
 

Re: [patch] applicom: use correct array offset

[Arnd Bergmann]

On Friday 01 March 2013, Dan Carpenter wrote:
> We're iterating through abps[] printing information, but here we
> use the wrong array index.  IndexCard comes from the user and in
> this case it was specifically not range checked because we didn't
> expect to use it.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Acked-by: Arnd Bergmann <arnd@arndb.de>

Wow, that is a crappy driver ;-) Dave Woodhouse was apparently the last
person who understood it and had something to do with it, and that was back
in the 90s. It looks like the vendor actually has its own (much worse)
driver for this product line and only supports more recent cards than
our driver does. I doubt that there is anyone using this.

Should we just kill the driver?

	Arnd