diff options
author | Eric Sesterhenn <snakebyte@gmx.de> | 2006-06-01 23:48:45 -0400 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2006-06-21 18:04:15 -0400 |
commit | d5ce1379be9c79d4bcf201c20c5cc87bb2bc973c (patch) | |
tree | 35920fe3fd457b4a472dfa999b76393637d2d544 | |
parent | b10cee9d035db54d0bf5a9f9fa622dcfc3f740c6 (diff) |
[PATCH] USB: negative index in drivers/usb/host/isp116x-hcd.c
From: Eric Sesterhenn <snakebyte@gmx.de>
This fixes coverity Bug #390.
With the following code
ret = ep->branch = balance(isp116x, ep->period, ep->load);
if (ret < 0)
goto fail;
the problem is that ret and balance are of the type int, and ep->branch is u16.
so the int balance() returns gets reduced to u16 and then converted to an int again,
which removes the sign. Maybe the following little c program can explain it better:
-rw-r--r-- | drivers/usb/host/isp116x-hcd.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c index e99210b7909b..c5e224048efa 100644 --- a/drivers/usb/host/isp116x-hcd.c +++ b/drivers/usb/host/isp116x-hcd.c | |||
@@ -781,7 +781,7 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd, | |||
781 | if (ep->branch < PERIODIC_SIZE) | 781 | if (ep->branch < PERIODIC_SIZE) |
782 | break; | 782 | break; |
783 | 783 | ||
784 | ret = ep->branch = balance(isp116x, ep->period, ep->load); | 784 | ep->branch = ret = balance(isp116x, ep->period, ep->load); |
785 | if (ret < 0) | 785 | if (ret < 0) |
786 | goto fail; | 786 | goto fail; |
787 | ret = 0; | 787 | ret = 0; |