[PATCH] staging: speakup: ensure we do not overrun synths array

[PATCH] staging: speakup: ensure we do not overrun synths array

[Colin King]

From: Colin Ian King <colin.king@canonical.com>

synth_add allows one to add MAXSYNTHS synths to the synths array;
however it always NULLifies the next synth in the array which
means that on the MAXSYNTHS synth we get an out-of-bounds write of
the NULL to the synths array.  Make the synths array MAXSYNTHS + 1
elements in size to allow for the final NULL sentinal to avoid the
out-of-bounds write.

Issue found wit CoverityScan, CID#744671

Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/staging/speakup/synth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/speakup/synth.c b/drivers/staging/speakup/synth.c
index 4f462c3..810a214 100644
--- a/drivers/staging/speakup/synth.c
+++ b/drivers/staging/speakup/synth.c
@@ -18,7 +18,7 @@
 #include "serialio.h"
 
 #define MAXSYNTHS       16      /* Max number of synths in array. */
-static struct spk_synth *synths[MAXSYNTHS];
+static struct spk_synth *synths[MAXSYNTHS + 1];
 struct spk_synth *synth;
 char spk_pitch_buff[32] = "";
 static int module_status;
-- 
2.8.1

Re: [PATCH] staging: speakup: ensure we do not overrun synths array

[Samuel Thibault]

Colin King, on Mon 09 May 2016 23:22:14 +0100, wrote:
> From: Colin Ian King <colin.king@canonical.com>
> 
> synth_add allows one to add MAXSYNTHS synths to the synths array;
> however it always NULLifies the next synth in the array which
> means that on the MAXSYNTHS synth we get an out-of-bounds write of
> the NULL to the synths array.  Make the synths array MAXSYNTHS + 1
> elements in size to allow for the final NULL sentinal to avoid the
> out-of-bounds write.
> 
> Issue found wit CoverityScan, CID#744671
> 
> Signed-off-by: Colin Ian King <colin.king@canonical.com>

Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

> ---
>  drivers/staging/speakup/synth.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/speakup/synth.c b/drivers/staging/speakup/synth.c
> index 4f462c3..810a214 100644
> --- a/drivers/staging/speakup/synth.c
> +++ b/drivers/staging/speakup/synth.c
> @@ -18,7 +18,7 @@
>  #include "serialio.h"
>  
>  #define MAXSYNTHS       16      /* Max number of synths in array. */
> -static struct spk_synth *synths[MAXSYNTHS];
> +static struct spk_synth *synths[MAXSYNTHS + 1];
>  struct spk_synth *synth;
>  char spk_pitch_buff[32] = "";
>  static int module_status;
> -- 
> 2.8.1
> 

-- 
Samuel
Actually, typing random strings in the Finder does the equivalent of
filename completion.
(Discussion in comp.os.linux.misc on the intuitiveness of commands: file
completion vs. the Mac Finder.)