aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/usb/serial
diff options
context:
space:
mode:
authorMatthias Urlichs <smurf@smurf.noris.de>2006-04-10 23:01:44 -0400
committerLinus Torvalds <torvalds@g5.osdl.org>2006-04-11 09:24:15 -0400
commit6dde432553551ae036aae12c2b940677d36c9a5b (patch)
tree2998fe9a1f6517717a7433f2fcf318b176fc1492 /drivers/usb/serial
parent397eeab321e87d8c1ef928b58f256513e6f481dc (diff)
[PATCH] Overrun in option-card USB driver
Since the arrays are declared as in_urbs[N_IN_URB] and out_urbs[N_OUT_URB], both for loops go one over the end of the array. This fixes coverity id #555. Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de> Signed-Off-By: Matthias Urlichs <smurf@smurf.noris.de> Signed-Off-By: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/usb/serial')
-rw-r--r--drivers/usb/serial/option.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 495db5755df9..5cf2b80add7a 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -28,6 +28,7 @@
28 2005-09-10 v0.4.3 added HUAWEI E600 card and Audiovox AirCard 28 2005-09-10 v0.4.3 added HUAWEI E600 card and Audiovox AirCard
29 2005-09-20 v0.4.4 increased recv buffer size: the card sometimes 29 2005-09-20 v0.4.4 increased recv buffer size: the card sometimes
30 wants to send >2000 bytes. 30 wants to send >2000 bytes.
31 2006-04-10 v0.4.2 fixed two array overrun errors :-/
31 32
32 Work sponsored by: Sigos GmbH, Germany <info@sigos.de> 33 Work sponsored by: Sigos GmbH, Germany <info@sigos.de>
33 34
@@ -582,14 +583,14 @@ static void option_setup_urbs(struct usb_serial *serial)
582 portdata = usb_get_serial_port_data(port); 583 portdata = usb_get_serial_port_data(port);
583 584
584 /* Do indat endpoints first */ 585 /* Do indat endpoints first */
585 for (j = 0; j <= N_IN_URB; ++j) { 586 for (j = 0; j < N_IN_URB; ++j) {
586 portdata->in_urbs[j] = option_setup_urb (serial, 587 portdata->in_urbs[j] = option_setup_urb (serial,
587 port->bulk_in_endpointAddress, USB_DIR_IN, port, 588 port->bulk_in_endpointAddress, USB_DIR_IN, port,
588 portdata->in_buffer[j], IN_BUFLEN, option_indat_callback); 589 portdata->in_buffer[j], IN_BUFLEN, option_indat_callback);
589 } 590 }
590 591
591 /* outdat endpoints */ 592 /* outdat endpoints */
592 for (j = 0; j <= N_OUT_URB; ++j) { 593 for (j = 0; j < N_OUT_URB; ++j) {
593 portdata->out_urbs[j] = option_setup_urb (serial, 594 portdata->out_urbs[j] = option_setup_urb (serial,
594 port->bulk_out_endpointAddress, USB_DIR_OUT, port, 595 port->bulk_out_endpointAddress, USB_DIR_OUT, port,
595 portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback); 596 portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback);