From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752902AbcEIWWb (ORCPT ); Mon, 9 May 2016 18:22:31 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:56352 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752301AbcEIWW3 (ORCPT ); Mon, 9 May 2016 18:22:29 -0400 From: Colin King To: William Hubbs , Chris Brannon , Kirk Reiser , Samuel Thibault , Greg Kroah-Hartman , Amitoj Kaur Chawla , speakup@linux-speakup.org, devel@driverdev.osuosl.org Cc: linux-kernel@vger.kernel.org Subject: [PATCH] staging: speakup: ensure we do not overrun synths array Date: Mon, 9 May 2016 23:22:14 +0100 Message-Id: <1462832534-11128-1-git-send-email-colin.king@canonical.com> X-Mailer: git-send-email 2.8.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Colin Ian King synth_add allows one to add MAXSYNTHS synths to the synths array; however it always NULLifies the next synth in the array which means that on the MAXSYNTHS synth we get an out-of-bounds write of the NULL to the synths array. Make the synths array MAXSYNTHS + 1 elements in size to allow for the final NULL sentinal to avoid the out-of-bounds write. Issue found wit CoverityScan, CID#744671 Signed-off-by: Colin Ian King --- drivers/staging/speakup/synth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/speakup/synth.c b/drivers/staging/speakup/synth.c index 4f462c3..810a214 100644 --- a/drivers/staging/speakup/synth.c +++ b/drivers/staging/speakup/synth.c @@ -18,7 +18,7 @@ #include "serialio.h" #define MAXSYNTHS 16 /* Max number of synths in array. */ -static struct spk_synth *synths[MAXSYNTHS]; +static struct spk_synth *synths[MAXSYNTHS + 1]; struct spk_synth *synth; char spk_pitch_buff[32] = ""; static int module_status; -- 2.8.1