lkml.org 
[lkml]   [2022]   [Jun]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 1/2] char: lp: ensure that index has not exceeded LP_NO
Date
From: Shreenidhi Shedi <sshedi@vmware.com>

After finishing the loop, index value can be equal to LP_NO and lp_table
array is of size LP_NO, so this can end up in accessing an out of bound
address in lp_register function.

Signed-off-by: Shreenidhi Shedi <sshedi@vmware.com>
---
drivers/char/lp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/char/lp.c b/drivers/char/lp.c
index 0e22e3b0a..d474d02b6 100644
--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -972,7 +972,7 @@ static void lp_attach(struct parport *port)
if (port_num[i] == -1)
break;

- if (!lp_register(i, port))
+ if (i < LP_NO && !lp_register(i, port))
lp_count++;
break;

--
2.36.1
\
 
 \ /
  Last update: 2022-06-03 15:02    [W:0.056 / U:0.500 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site