diff options
| author | Christopher Brannon <chris@the-brannons.com> | 2011-02-21 14:07:10 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-02-23 14:39:09 -0800 |
| commit | 87be424a9a4be41df26b25b3360969211cedd5d1 (patch) | |
| tree | cf0cfa4d90a083e79904f5a5e0b2c9270a25deae | |
| parent | 1af4791552e462b37d0174407dc3173917e35ea0 (diff) | |
| download | talos-obmc-linux-87be424a9a4be41df26b25b3360969211cedd5d1.tar.gz talos-obmc-linux-87be424a9a4be41df26b25b3360969211cedd5d1.zip | |
Staging: speakup: fix an out-of-bounds error.
The cur_item variable from keyhelp.c is an index into a table of
messages. The following condition should always hold:
MSG_FUNCNAMES_START + cur_item <= MSG_FUNCNAMES_END.
The check in keyhelp.c was wrong. It allowed cur_item to be
incremented to an out-of-bounds value.
Signed-off-by: Christopher Brannon <chris@the-brannons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/staging/speakup/keyhelp.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/staging/speakup/keyhelp.c b/drivers/staging/speakup/keyhelp.c index 236f06d35ca6..23cf7f44f450 100644 --- a/drivers/staging/speakup/keyhelp.c +++ b/drivers/staging/speakup/keyhelp.c @@ -161,7 +161,9 @@ int handle_help(struct vc_data *vc, u_char type, u_char ch, u_short key) } cur_item = letter_offsets[ch-'a']; } else if (type == KT_CUR) { - if (ch == 0 && (cur_item + 1) <= MSG_FUNCNAMES_END) + if (ch == 0 + && (MSG_FUNCNAMES_START + cur_item + 1) <= + MSG_FUNCNAMES_END) cur_item++; else if (ch == 3 && cur_item > 0) cur_item--; |
