Skip to contentSkip to conversation

input: off by one in pcf8574_kp_irq_handler()

PATCH Applied Dan Carpenter 3 participants 3 messages Jun 4, 2010 – Jun 5, 2010

Subsystems (3)
Kernel janitors HID Input drivers
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 input: off by one in pcf8574_kp_irq_handler()

If nextstate = ARRAY_SIZE(lp->btncode), then we read one past the end of the array on the next line.

This fixes a smatch warning:
drivers/input/misc/pcf8574_keypad.c +74 pcf8574_kp_irq_handler(8)

	error: buffer overflow 'lp->btncode' 17 <= 17
Signed-off-by Dan Carpenter <[email protected]>
drivers/input/misc/pcf8574_keypad.c +1 -1
index 0ac47d2..4b42ffc 100644
@@ -69,7 +69,7 @@ static irqreturn_t pcf8574_kp_irq_handler(int irq, void *dev_id)
 	unsigned char nextstate = read_state(lp);
 
 	if (lp->laststate != nextstate) {
-		int key_down = nextstate <= ARRAY_SIZE(lp->btncode);
+		int key_down = nextstate < ARRAY_SIZE(lp->btncode);
 		unsigned short keycode = key_down ?
 			lp->btncode[nextstate] : lp->btncode[lp->laststate];
Acked-by on v1 1/1
#1 lore raw

Hi Dan,

Quoted 14 lines · Dan Carpenter

If nextstate = ARRAY_SIZE(lp->btncode), then we read one past the end of the array on the next line.

This fixes a smatch warning:
drivers/input/misc/pcf8574_keypad.c +74 pcf8574_kp_irq_handler(8)

	error: buffer overflow 'lp->btncode' 17 <= 17
Signed-off-by Dan Carpenter <[email protected]>
drivers/input/misc/pcf8574_keypad.c +0 -0
index 0ac47d2..4b42ffc 100644

drivers/input/misc/pcf8574_keypad.c static irqreturn_t pcf8574_kp_irq_handler(int irq, void *dev_id) · line 75

Quoted 8 lines
drivers/input/misc/pcf8574_keypad.c +1 -1
@@ -69,7 +69,7 @@ static irqreturn_t pcf8574_kp_irq_handler(int irq, void *dev_id)
 	unsigned char nextstate = read_state(lp);
 
 	if (lp->laststate != nextstate) {
-		int key_down = nextstate <= ARRAY_SIZE(lp->btncode);
+		int key_down = nextstate < ARRAY_SIZE(lp->btncode);
 		unsigned short keycode = key_down ?
 			lp->btncode[nextstate] : lp->btncode[lp->laststate];

Good catch.

Acked-by Jean Delvare <[email protected]>
Signature · 1 line
Jean Delvare
maintainer Applied
#2 lore raw
Quoted 28 lines · Jean Delvare

Hi Dan,

Quoted 14 lines · Dan Carpenter

If nextstate = ARRAY_SIZE(lp->btncode), then we read one past the end of the array on the next line.

This fixes a smatch warning:
drivers/input/misc/pcf8574_keypad.c +74 pcf8574_kp_irq_handler(8)

	error: buffer overflow 'lp->btncode' 17 <= 17
Signed-off-by Dan Carpenter <[email protected]>
drivers/input/misc/pcf8574_keypad.c +0 -0
index 0ac47d2..4b42ffc 100644

drivers/input/misc/pcf8574_keypad.c static irqreturn_t pcf8574_kp_irq_handler(int irq, void *dev_id) · line 75

Quoted 8 lines
drivers/input/misc/pcf8574_keypad.c +1 -1
@@ -69,7 +69,7 @@ static irqreturn_t pcf8574_kp_irq_handler(int irq, void *dev_id)
 	unsigned char nextstate = read_state(lp);
 
 	if (lp->laststate != nextstate) {
-		int key_down = nextstate <= ARRAY_SIZE(lp->btncode);
+		int key_down = nextstate < ARRAY_SIZE(lp->btncode);
 		unsigned short keycode = key_down ?
 			lp->btncode[nextstate] : lp->btncode[lp->laststate];

Good catch.

Quoted 2 lines
Acked-by Jean Delvare <[email protected]>

Applied to 'for-linus', thanks Dan.

Signature · 1 line
Dmitry