Skip to contentSkip to conversation

applicom: use correct array offset

PATCH In review Dan Carpenter 2 participants 2 messages Mar 1, 2013

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 applicom: use correct array offset

We're iterating through abps[] printing information, but here we use the wrong array index. IndexCard comes from the user and in this case it was specifically not range checked because we didn't expect to use it.

drivers/char/applicom.c +2 -2
index 25373df..974321a 100644
@@ -804,8 +804,8 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
 			printk(KERN_INFO "Prom version board %d ....... V%d.%d %s",
 			       i+1,
-			       (int)(readb(apbs[IndexCard].RamIO + VERS) >> 4),
-			       (int)(readb(apbs[IndexCard].RamIO + VERS) & 0xF),
+			       (int)(readb(apbs[i].RamIO + VERS) >> 4),
+			       (int)(readb(apbs[i].RamIO + VERS) & 0xF),
 			       boardname);
 
 
maintainer Acked-by on v1 1/1
#1 lore raw
Quoted 6 lines · Dan Carpenter

We're iterating through abps[] printing information, but here we use the wrong array index. IndexCard comes from the user and in this case it was specifically not range checked because we didn't expect to use it.

Wow, that is a crappy driver ;-) Dave Woodhouse was apparently the last person who understood it and had something to do with it, and that was back in the 90s. It looks like the vendor actually has its own (much worse) driver for this product line and only supports more recent cards than our driver does. I doubt that there is anyone using this.

Should we just kill the driver?

Arnd