leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Input: pcf8574_keypad - fix off by one in pcf8574_kp_irq_handler()

Browse Source 
If nextstate == ARRAY_SIZE(lp->btncode), then we read one past the end of
the array on the next line.

This fixes a smatch warning:
drivers/input/misc/pcf8574_keypad.c +74 pcf8574_kp_irq_handler(8)
	error: buffer overflow 'lp->btncode' 17 <= 17

Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
This commit is contained in:
Dan Carpenter 2010-06-05 00:34:08 -07:00 committed by Dmitry Torokhov
parent 3a4b4aaa54
commit 0b75f77528
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/input/misc/pcf8574_keypad.c
View File

@ -69,7 +69,7 @@ static irqreturn_t pcf8574_kp_irq_handler(int irq, void *dev_id)
unsigned char nextstate = read_state(lp);
if (lp->laststate != nextstate) {
int key_down = nextstate <= ARRAY_SIZE(lp->btncode);
int key_down = nextstate < ARRAY_SIZE(lp->btncode);
unsigned short keycode = key_down ?
lp->btncode[nextstate] : lp->btncode[lp->laststate];