From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755901Ab3AET34 (ORCPT ); Sat, 5 Jan 2013 14:29:56 -0500 Received: from toccata.ens-lyon.org ([140.77.166.68]:57803 "EHLO toccata.ens-lyon.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755832Ab3AET3w (ORCPT ); Sat, 5 Jan 2013 14:29:52 -0500 Date: Sat, 5 Jan 2013 20:29:44 +0100 From: Samuel Thibault To: Nickolai Zeldovich , gregkh@linuxfoundation.org Cc: William Hubbs , Chris Brannon , Kirk Reiser , linux-kernel@vger.kernel.org, speakup@braille.uwo.ca Subject: Re: [PATCH] drivers/staging/speakup: avoid out-of-range access Message-ID: <20130105192944.GL5965@type.youpi.perso.aquilenet.fr> Mail-Followup-To: Samuel Thibault , Nickolai Zeldovich , gregkh@linuxfoundation.org, William Hubbs , Chris Brannon , Kirk Reiser , linux-kernel@vger.kernel.org, speakup@braille.uwo.ca References: <1357413465-42357-1-git-send-email-nickolai@csail.mit.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1357413465-42357-1-git-send-email-nickolai@csail.mit.edu> User-Agent: Mutt/1.5.21+34 (58baf7c9f32f) (2010-12-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Indeed. The same happens in synth_add, so Greg please use this instead: Check that array index is in-bounds before accessing the synths[] array. Signed-off-by: Nickolai Zeldovich Signed-off-by: Samuel Thibault --- drivers/staging/speakup/synth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/speakup/synth.c b/drivers/staging/speakup/synth.c index df95337..b91d22b 100644 --- a/drivers/staging/speakup/synth.c +++ b/drivers/staging/speakup/synth.c @@ -342,7 +342,7 @@ int synth_init(char *synth_name) mutex_lock(&spk_mutex); /* First, check if we already have it loaded. */ - for (i = 0; synths[i] != NULL && i < MAXSYNTHS; i++) + for (i = 0; i < MAXSYNTHS && synths[i] != NULL; i++) if (strcmp(synths[i]->name, synth_name) == 0) synth = synths[i]; @@ -423,7 +423,7 @@ int synth_add(struct spk_synth *in_synth int i; int status = 0; mutex_lock(&spk_mutex); - for (i = 0; synths[i] != NULL && i < MAXSYNTHS; i++) + for (i = 0; i < MAXSYNTHS && synths[i] != NULL; i++) /* synth_remove() is responsible for rotating the array down */ if (in_synth == synths[i]) { mutex_unlock(&spk_mutex);