mtd: intflmount: fix off by one error in INFTL_dumpVUchains()
Linux-MTD Mailing List
linux-mtd at lists.infradead.org
Mon Dec 15 19:59:06 PST 2014
Gitweb: http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=e8e6c875658c39624fc8cb4c6f3e1b6ab9ce1b6e
Commit: e8e6c875658c39624fc8cb4c6f3e1b6ab9ce1b6e
Parent: f02985b78550f5ee9d8d0603b21fd7d98ca58c1c
Author: Dan Carpenter <dan.carpenter at oracle.com>
AuthorDate: Tue Oct 21 11:08:35 2014 +0300
Committer: Brian Norris <computersforpeace at gmail.com>
CommitDate: Wed Nov 5 13:19:21 2014 -0800
mtd: intflmount: fix off by one error in INFTL_dumpVUchains()
The ->PUtable[] array has "->nb_blocks" number of elemetns so this
comparison should be ">=" instead of ">". Otherwise it could result in
a minor read beyond the end of an array.
Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
Signed-off-by: Brian Norris <computersforpeace at gmail.com>
---
drivers/mtd/inftlmount.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
index 487e64f..1388c8d 100644
--- a/drivers/mtd/inftlmount.c
+++ b/drivers/mtd/inftlmount.c
@@ -518,7 +518,7 @@ void INFTL_dumpVUchains(struct INFTLrecord *s)
pr_debug("INFTL Virtual Unit Chains:\n");
for (logical = 0; logical < s->nb_blocks; logical++) {
block = s->VUtable[logical];
- if (block > s->nb_blocks)
+ if (block >= s->nb_blocks)
continue;
pr_debug(" LOGICAL %d --> %d ", logical, block);
for (i = 0; i < s->nb_blocks; i++) {
More information about the linux-mtd-cvs
mailing list