Skip to contentSkip to conversation

mtd: off by one in INFTL_dumpVUchains()

PATCH Applied Dan Carpenter 2 participants 2 messages Oct 21, 2014 – Nov 5, 2014

Subsystems (2)
Kernel janitors Memory technology devices (MTD)
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 mtd: off by one in INFTL_dumpVUchains()

The ->PUtable[] array has "->nb_blocks" number of elemetns so this comparison should be ">=" instead of ">". Otherwise it could result in a minor read beyond the end of an array.

Signed-off-by Dan Carpenter <[email protected]>

---
Static analysis stuff. Not tested.

drivers/mtd/inftlmount.c +1 -1
index 487e64f..1388c8d 100644
@@ -518,7 +518,7 @@ void INFTL_dumpVUchains(struct INFTLrecord *s)
 	pr_debug("INFTL Virtual Unit Chains:\n");
 	for (logical = 0; logical < s->nb_blocks; logical++) {
 		block = s->VUtable[logical];
-		if (block > s->nb_blocks)
+		if (block >= s->nb_blocks)
 			continue;
 		pr_debug("  LOGICAL %d --> %d ", logical, block);
 		for (i = 0; i < s->nb_blocks; i++) {
Applied
#1 lore raw
Quoted 5 lines · Dan Carpenter

The ->PUtable[] array has "->nb_blocks" number of elemetns so this comparison should be ">=" instead of ">". Otherwise it could result in a minor read beyond the end of an array.

Signed-off-by Dan Carpenter <[email protected]>

Pushed to l2-mtd.git.

Brian