aboutsummaryrefslogtreecommitdiff
path: root/drivers/staging/speakup
diff options
context:
space:
mode:
authorChristopher Brannon <chris@the-brannons.com>2011-02-21 14:07:10 +0000
committerGreg Kroah-Hartman <gregkh@suse.de>2011-02-23 14:39:09 -0800
commit87be424a9a4be41df26b25b3360969211cedd5d1 (patch)
treecf0cfa4d90a083e79904f5a5e0b2c9270a25deae /drivers/staging/speakup
parent1af4791552e462b37d0174407dc3173917e35ea0 (diff)
downloadlinaro-lsk-87be424a9a4be41df26b25b3360969211cedd5d1.tar.gz
Staging: speakup: fix an out-of-bounds error.
The cur_item variable from keyhelp.c is an index into a table of messages. The following condition should always hold: MSG_FUNCNAMES_START + cur_item <= MSG_FUNCNAMES_END. The check in keyhelp.c was wrong. It allowed cur_item to be incremented to an out-of-bounds value. Signed-off-by: Christopher Brannon <chris@the-brannons.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/staging/speakup')
-rw-r--r--drivers/staging/speakup/keyhelp.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/staging/speakup/keyhelp.c b/drivers/staging/speakup/keyhelp.c
index 236f06d35ca..23cf7f44f45 100644
--- a/drivers/staging/speakup/keyhelp.c
+++ b/drivers/staging/speakup/keyhelp.c
@@ -161,7 +161,9 @@ int handle_help(struct vc_data *vc, u_char type, u_char ch, u_short key)
}
cur_item = letter_offsets[ch-'a'];
} else if (type == KT_CUR) {
- if (ch == 0 && (cur_item + 1) <= MSG_FUNCNAMES_END)
+ if (ch == 0
+ && (MSG_FUNCNAMES_START + cur_item + 1) <=
+ MSG_FUNCNAMES_END)
cur_item++;
else if (ch == 3 && cur_item > 0)
cur_item--;