diff options
author | Roel Kluin <roel.kluin@gmail.com> | 2009-08-07 18:14:20 -0400 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-09-15 15:01:34 -0400 |
commit | 4ff863b1db411481971de481002aa644057b1fa6 (patch) | |
tree | 5b6ef25ec5f31e80805e37a32ea0f49be3268ad9 | |
parent | 88a28c828f25f15bf8258ae834bcb47adf3e67b4 (diff) |
Staging: comedi: s626: Possible read buffer overflow fix
If `cmd->chanlist_len' is 0, then we write ppl[-1].
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r-- | drivers/staging/comedi/drivers/s626.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/staging/comedi/drivers/s626.c b/drivers/staging/comedi/drivers/s626.c index 6549d116f2e..80d2787d106 100644 --- a/drivers/staging/comedi/drivers/s626.c +++ b/drivers/staging/comedi/drivers/s626.c | |||
@@ -1707,7 +1707,8 @@ static int s626_ai_load_polllist(uint8_t * ppl, struct comedi_cmd *cmd) | |||
1707 | else | 1707 | else |
1708 | ppl[n] = (CR_CHAN((cmd->chanlist)[n])) | (RANGE_10V); | 1708 | ppl[n] = (CR_CHAN((cmd->chanlist)[n])) | (RANGE_10V); |
1709 | } | 1709 | } |
1710 | ppl[n - 1] |= EOPL; | 1710 | if (n != 0) |
1711 | ppl[n - 1] |= EOPL; | ||
1711 | 1712 | ||
1712 | return n; | 1713 | return n; |
1713 | } | 1714 | } |