redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity

Staging: speakup: fix an out-of-bounds error.

Browse source 
The cur_item variable from keyhelp.c is an index into a table of
messages.  The following condition should always hold:
MSG_FUNCNAMES_START + cur_item <= MSG_FUNCNAMES_END.
The check in keyhelp.c was wrong.  It allowed cur_item to be
incremented to an out-of-bounds value.

Signed-off-by: Christopher Brannon <chris@the-brannons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Christopher Brannon 2011-02-21 14:07:10 +00:00 committed by Greg Kroah-Hartman
parent 1af4791552
commit 87be424a9a
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
drivers/staging/speakup/keyhelp.c
View file

@ -161,7 +161,9 @@ int handle_help(struct vc_data *vc, u_char type, u_char ch, u_short key)
}
cur_item = letter_offsets[ch-'a'];
} else if (type == KT_CUR) {
if (ch == 0 && (cur_item + 1) <= MSG_FUNCNAMES_END)
if (ch == 0
&& (MSG_FUNCNAMES_START + cur_item + 1) <=
MSG_FUNCNAMES_END)
cur_item++;
else if (ch == 3 && cur_item > 0)
cur_item--;