From: Christopher Brannon Date: Mon, 21 Feb 2011 14:07:10 +0000 (+0000) Subject: Staging: speakup: fix an out-of-bounds error. X-Git-Tag: MMI-PSA29.97-13-9~20521^2~425 X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=87be424a9a4be41df26b25b3360969211cedd5d1;p=GitHub%2FMotorolaMobilityLLC%2Fkernel-slsi.git Staging: speakup: fix an out-of-bounds error. The cur_item variable from keyhelp.c is an index into a table of messages. The following condition should always hold: MSG_FUNCNAMES_START + cur_item <= MSG_FUNCNAMES_END. The check in keyhelp.c was wrong. It allowed cur_item to be incremented to an out-of-bounds value. Signed-off-by: Christopher Brannon Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/staging/speakup/keyhelp.c b/drivers/staging/speakup/keyhelp.c index 236f06d35ca6..23cf7f44f450 100644 --- a/drivers/staging/speakup/keyhelp.c +++ b/drivers/staging/speakup/keyhelp.c @@ -161,7 +161,9 @@ int handle_help(struct vc_data *vc, u_char type, u_char ch, u_short key) } cur_item = letter_offsets[ch-'a']; } else if (type == KT_CUR) { - if (ch == 0 && (cur_item + 1) <= MSG_FUNCNAMES_END) + if (ch == 0 + && (MSG_FUNCNAMES_START + cur_item + 1) <= + MSG_FUNCNAMES_END) cur_item++; else if (ch == 3 && cur_item > 0) cur_item--;