From 5c820b80640508d34b2294b5fe8f78e0c20f3e3e Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Tue, 24 Jul 2018 19:11:26 +0200 Subject: video: fbdev: metronomefb: fix some off by one bugs The "mem" buffer has "size" bytes. The ">" should be ">=" to prevent reading one character beyond the end of the array. Signed-off-by: Dan Carpenter Signed-off-by: Bartlomiej Zolnierkiewicz --- drivers/video/fbdev/metronomefb.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'drivers/video') diff --git a/drivers/video/fbdev/metronomefb.c b/drivers/video/fbdev/metronomefb.c index 9085e9525341..bb4fee52e501 100644 --- a/drivers/video/fbdev/metronomefb.c +++ b/drivers/video/fbdev/metronomefb.c @@ -233,7 +233,7 @@ static int load_waveform(u8 *mem, size_t size, int m, int t, /* check temperature range table checksum */ cksum_idx = sizeof(*wfm_hdr) + wfm_hdr->trc + 1; - if (cksum_idx > size) + if (cksum_idx >= size) return -EINVAL; cksum = calc_cksum(sizeof(*wfm_hdr), cksum_idx, mem); if (cksum != mem[cksum_idx]) { @@ -245,7 +245,7 @@ static int load_waveform(u8 *mem, size_t size, int m, int t, /* check waveform mode table address checksum */ wmta = get_unaligned_le32(wfm_hdr->wmta) & 0x00FFFFFF; cksum_idx = wmta + m*4 + 3; - if (cksum_idx > size) + if (cksum_idx >= size) return -EINVAL; cksum = calc_cksum(cksum_idx - 3, cksum_idx, mem); if (cksum != mem[cksum_idx]) { @@ -257,7 +257,7 @@ static int load_waveform(u8 *mem, size_t size, int m, int t, /* check waveform temperature table address checksum */ tta = get_unaligned_le32(mem + wmta + m * 4) & 0x00FFFFFF; cksum_idx = tta + trn*4 + 3; - if (cksum_idx > size) + if (cksum_idx >= size) return -EINVAL; cksum = calc_cksum(cksum_idx - 3, cksum_idx, mem); if (cksum != mem[cksum_idx]) { @@ -270,7 +270,7 @@ static int load_waveform(u8 *mem, size_t size, int m, int t, metromem buffer. this does runlength decoding of the waveform */ wfm_idx = get_unaligned_le32(mem + tta + trn * 4) & 0x00FFFFFF; owfm_idx = wfm_idx; - if (wfm_idx > size) + if (wfm_idx >= size) return -EINVAL; while (wfm_idx < size) { unsigned char rl; @@ -292,7 +292,7 @@ static int load_waveform(u8 *mem, size_t size, int m, int t, } cksum_idx = wfm_idx; - if (cksum_idx > size) + if (cksum_idx >= size) return -EINVAL; cksum = calc_cksum(owfm_idx, cksum_idx, mem); if (cksum != mem[cksum_idx]) { -- cgit v1.2.3