Staging: ft1000-usb: fix array overflow

PATCH In review Dan Carpenter 1 participant 1 message Oct 15, 2010

Subsystems (2)

Staging Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2010-10-15 03:42 UTC #0 lore raw

PATCH 2/2 Staging: ft1000-usb: fix array overflow

The code here is supposed checking if we exited the loop without hitting a break. The problem is that in the error handling "i" is out of bounds and it corrupts memory when we do an info->app_info[i].nRxMsgMiss++. From the comments, it looks like someone noticed this corruption and updated the code, but didn't totally fix the problem. The correct fix is just to remove nRxMsgMiss++ from the error path.

I believe this bug can be triggered remotely.

Signed-off-by Dan Carpenter <[email protected]>

drivers/staging/ft1000/ft1000-usb/ft1000_hw.c +1 -2

index 076ba75..d33dc06 100644
@@ -2647,8 +2647,7 @@ int ft1000_poll(void* dev_id) {
                                    }
                                }
 
-                               if (i=(MAX_NUM_APP-1)) {		// aelias [+] reason: was out of array boundary
-                                   info->app_info[i].nRxMsgMiss++;
+                               if (i = MAX_NUM_APP) {
                                    DEBUG("FT1000:ft1000_parse_dpram_msg: No application matching id = %d\n", ppseudo_hdr->portdest);
                                    // Put memory back to free pool
                                    ft1000_free_buffer(pdpram_blk, &freercvpool);