[PATCH] Overrun in option-card USB driver

Since the arrays are declared as in_urbs[N_IN_URB]
and out_urbs[N_OUT_URB], both for loops go one
over the end of the array. This fixes coverity id #555.

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-Off-By: Matthias Urlichs <smurf@smurf.noris.de>
Signed-Off-By: Linus Torvalds <torvalds@osdl.org>

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 495db5755df9e3a1ea1ff7aae075d8853c8b1485..5cf2b80add7aa01ede3b1a588dc5c002d6dbccb8 100644 (file)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -28,6 +28,7 @@
   2005-09-10  v0.4.3 added HUAWEI E600 card and Audiovox AirCard
   2005-09-20  v0.4.4 increased recv buffer size: the card sometimes
                      wants to send >2000 bytes.
+  2006-04-10  v0.4.2 fixed two array overrun errors :-/
 
   Work sponsored by: Sigos GmbH, Germany <info@sigos.de>
 
@@ -582,14 +583,14 @@ static void option_setup_urbs(struct usb_serial *serial)
        portdata = usb_get_serial_port_data(port);
 
        /* Do indat endpoints first */
-       for (j = 0; j <= N_IN_URB; ++j) {
+       for (j = 0; j < N_IN_URB; ++j) {
                portdata->in_urbs[j] = option_setup_urb (serial,
                   port->bulk_in_endpointAddress, USB_DIR_IN, port,
                   portdata->in_buffer[j], IN_BUFLEN, option_indat_callback);
        }
 
        /* outdat endpoints */
-       for (j = 0; j <= N_OUT_URB; ++j) {
+       for (j = 0; j < N_OUT_URB; ++j) {
                portdata->out_urbs[j] = option_setup_urb (serial,
                   port->bulk_out_endpointAddress, USB_DIR_OUT, port,
                   portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback);