Re: [PATCH] carminefb: beyond ARRAY_SIZE of carmine_modedb

On Wed, 20 May 2009 02:41:18 +0200 Roel Kluin [off-list ref] wrote:

CC: <redacted>, Andrew Morton <akpm@linux-foundation.org>

You mistyped the list address.

Subject: [PATCH] carminefb: beyond ARRAY_SIZE of carmine_modedb
Date: Wed, 20 May 2009 02:41:18 +0200
User-Agent: Thunderbird 2.0.0.21 (X11/20090302)

Do not go beyond ARRAY_SIZE ofcarmine_modedb

Sort-of.  I changed the title and changelog:


Subject: carminefb: fix possible access beyond end of carmine_modedb[]
From: Roel Kluin <redacted>

This check is off-by-one.

Signed-off-by: Roel Kluin <redacted>
Cc: Sebastian Siewior <bigeasy@linutronix.de>
Cc: Krzysztof Helt <redacted>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 drivers/video/carminefb.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff -puN drivers/video/carminefb.c~carminefb-beyond-array_size-of-carmine_modedb drivers/video/carminefb.c

--- a/drivers/video/carminefb.c~carminefb-beyond-array_size-of-carmine_modedb
+++ a/drivers/video/carminefb.c

@@ -562,7 +562,7 @@ static int __devinit alloc_carmine_fb(vo
 	if (ret < 0)
 		goto err_free_fb;
 
-	if (fb_mode > ARRAY_SIZE(carmine_modedb))
+	if (fb_mode >= ARRAY_SIZE(carmine_modedb))
 		fb_mode = CARMINEFB_DEFAULT_VIDEO_MODE;
 
 	par->cur_mode = par->new_mode = ~0;

_


------------------------------------------------------------------------------
Register Now for Creativity and Technology (CaT), June 3rd, NYC. CaT 
is a gathering of tech-side developers & brand creativity professionals. Meet
the minds behind Google Creative Lab, Visual Complexity, Processing, & 
iPhoneDevCamp as they present alongside digital heavyweights like Barbarian 
Group, R/GA, & Big Spaceship. http://p.sf.net/sfu/creativitycat-com