aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/char/hvc_beat.c
diff options
context:
space:
mode:
authorIshizaki Kou <kou.ishizaki@toshiba.co.jp>2008-03-17 06:05:18 -0400
committerPaul Mackerras <paulus@samba.org>2008-04-16 17:46:10 -0400
commit55045d47d7a8c4c61bc0ca6f2fac5087dd598bc3 (patch)
treee2a2c327604d0c521a59a49524655248831412c9 /drivers/char/hvc_beat.c
parent2fe37a6ec933ca7332a8ca8d29e87705116afd3a (diff)
[POWERPC] hvcbeat: Fix buffer manipulation
This fixes a potential bug at drivers/char/hvc_beat.c. - hvc_put_term_char routine will decrement "rest" variable twice, and forget to advance "buf" pointer by "nlen" bytes. This bug was not hit previously because the output handler in drivers/char/hvc_console.c splits given output into 16 bytes at maximum. Reported-by: Timur Tabi <timur@freescale.com> Signed-off-by: Kou Ishizaki <kou.ishizaki@toshiba.co.jp> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Paul Mackerras <paulus@samba.org>
Diffstat (limited to 'drivers/char/hvc_beat.c')
-rw-r--r--drivers/char/hvc_beat.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/char/hvc_beat.c b/drivers/char/hvc_beat.c
index e74bb949c289..91cdb35a9204 100644
--- a/drivers/char/hvc_beat.c
+++ b/drivers/char/hvc_beat.c
@@ -78,8 +78,8 @@ static int hvc_beat_put_chars(uint32_t vtermno, const char *buf, int cnt)
78 for (rest = cnt; rest > 0; rest -= nlen) { 78 for (rest = cnt; rest > 0; rest -= nlen) {
79 nlen = (rest > 16) ? 16 : rest; 79 nlen = (rest > 16) ? 16 : rest;
80 memcpy(kb, buf, nlen); 80 memcpy(kb, buf, nlen);
81 beat_put_term_char(vtermno, rest, kb[0], kb[1]); 81 beat_put_term_char(vtermno, nlen, kb[0], kb[1]);
82 rest -= nlen; 82 buf += nlen;
83 } 83 }
84 return cnt; 84 return cnt;
85} 85}