Skip to content

Commit

Permalink
Staging: speakup: fix an out-of-bounds error.
Browse files Browse the repository at this point in the history
The cur_item variable from keyhelp.c is an index into a table of
messages.  The following condition should always hold:
MSG_FUNCNAMES_START + cur_item <= MSG_FUNCNAMES_END.
The check in keyhelp.c was wrong.  It allowed cur_item to be
incremented to an out-of-bounds value.

Signed-off-by: Christopher Brannon <chris@the-brannons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  • Loading branch information
Christopher Brannon authored and Greg Kroah-Hartman committed Feb 23, 2011
1 parent 1af4791 commit 87be424
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion drivers/staging/speakup/keyhelp.c
Original file line number Diff line number Diff line change
@@ -161,7 +161,9 @@ int handle_help(struct vc_data *vc, u_char type, u_char ch, u_short key)
}
cur_item = letter_offsets[ch-'a'];
} else if (type == KT_CUR) {
if (ch == 0 && (cur_item + 1) <= MSG_FUNCNAMES_END)
if (ch == 0
&& (MSG_FUNCNAMES_START + cur_item + 1) <=
MSG_FUNCNAMES_END)
cur_item++;
else if (ch == 3 && cur_item > 0)
cur_item--;

0 comments on commit 87be424

Please sign in to comment.