]> git.baikalelectronics.ru Git - kernel.git/commit
tty: max310x: fix off-by-one buffer access when storing overrun
authorJan Kundrát <jan.kundrat@cesnet.cz>
Wed, 28 Aug 2019 17:56:26 +0000 (19:56 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 4 Sep 2019 10:43:55 +0000 (12:43 +0200)
commitf8bece68239c76d24df90bb1e768cc6f33cb5c7d
tree03caa785fd706ffdc35684198a95f03680861a75
parentbd8267abc3740f16e5c3296246ce0fb9f2bd7f25
tty: max310x: fix off-by-one buffer access when storing overrun

A recent change split the insertion loop into two parts. The first part
accessed bytes 0, 1, ... (rxlen - 2), and the second part by mistake
took offset `rxlen` instead of the correct `rxlen - 1`. So one byte was
not stored, and the final access wrote past the end of the rx_buf.

Fixes: 75a8ab33c8c2 (tty: max310x: Split uart characters insertion loop)
Signed-off-by: Jan Kundrát <jan.kundrat@cesnet.cz>
Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
Link: https://lore.kernel.org/r/13ea227620aaad8a7231d42ed03a8508297d4eb3.1567027079.git.jan.kundrat@cesnet.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/tty/serial/max310x.c