* [patch] off by one error in rioctrl.c
@ 2009-08-07 12:10 Dan Carpenter
0 siblings, 0 replies; only message in thread
From: Dan Carpenter @ 2009-08-07 12:10 UTC (permalink / raw)
To: linux-kernel
I'm not sure who to send this to.
If DownLoad.ProductCode == MAX_PRODUCT, that would be a problem when we do
RIOBootTable[DownLoad.ProductCode] a couple lines down.
Found by smatch (http://repo.or.cz/w/smatch.git).
regards,
dan carpenter
Signed-off-by: Dan Carpenter <error27@gmail.com>
--- orig/drivers/char/rio/rioctrl.c 2009-08-03 21:44:01.000000000 +0200
+++ devel/drivers/char/rio/rioctrl.c 2009-08-03 21:44:26.000000000 +0200
@@ -873,7 +873,7 @@
/*
** It is important that the product code is an unsigned object!
*/
- if (DownLoad.ProductCode > MAX_PRODUCT) {
+ if (DownLoad.ProductCode >= MAX_PRODUCT) {
rio_dprintk(RIO_DEBUG_CTRL, "RIO_DOWNLOAD: Bad product code %d passed\n", DownLoad.ProductCode);
p->RIOError.Error = NO_SUCH_PRODUCT;
return -ENXIO;
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2009-08-07 12:10 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-08-07 12:10 [patch] off by one error in rioctrl.c Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®