Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1412092

[PATCH] iio: dac: fix off-by-one comparison and out-of-bounds write

Show all headers | View raw

From: Colin Ian King <colin.king@canonical.com>

The check on reg is off-by-one, it should be >= rather than >. Fix
this to stop an out-of-bounds write to st->channel_modes[reg].

Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/iio/dac/ad5592r-base.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/dac/ad5592r-base.c b/drivers/iio/dac/ad5592r-base.c
index 948f600..69bde59 100644
--- a/drivers/iio/dac/ad5592r-base.c
+++ b/drivers/iio/dac/ad5592r-base.c
@@ -525,7 +525,7 @@ static int ad5592r_alloc_channels(struct ad5592r_state *st)
 
 	device_for_each_child_node(st->dev, child) {
 		ret = fwnode_property_read_u32(child, "reg", &reg);
-		if (ret || reg > ARRAY_SIZE(st->channel_modes))
+		if (ret || reg >= ARRAY_SIZE(st->channel_modes))
 			continue;
 
 		ret = fwnode_property_read_u32(child, "adi,mode", &tmp);
-- 
2.8.1

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH] iio: dac: fix off-by-one comparison and out-of-bounds write Colin King <colin.king@canonical.com> - 2016-06-02 12:10 +0200
  Re: [PATCH] iio: dac: fix off-by-one comparison and out-of-bounds  write Jonathan Cameron <jic23@kernel.org> - 2016-06-03 14:10 +0200

csiph-web