From: Colin Ian King Date: Mon, 9 May 2016 22:22:14 +0000 (+0100) Subject: staging: speakup: ensure we do not overrun synths array X-Git-Tag: v4.9-rc1~119^2~1183 X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=99a9ffacc1d390e9548b2370beb816c6739b84b2;p=uclinux-h8%2Flinux.git staging: speakup: ensure we do not overrun synths array synth_add allows one to add MAXSYNTHS synths to the synths array; however it always NULLifies the next synth in the array which means that on the MAXSYNTHS synth we get an out-of-bounds write of the NULL to the synths array. Make the synths array MAXSYNTHS + 1 elements in size to allow for the final NULL sentinal to avoid the out-of-bounds write. Issue found wit CoverityScan, CID#744671 Signed-off-by: Colin Ian King Reviewed-by: Samuel Thibault Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/staging/speakup/synth.c b/drivers/staging/speakup/synth.c index 4f462c35fdd9..810a21408715 100644 --- a/drivers/staging/speakup/synth.c +++ b/drivers/staging/speakup/synth.c @@ -18,7 +18,7 @@ #include "serialio.h" #define MAXSYNTHS 16 /* Max number of synths in array. */ -static struct spk_synth *synths[MAXSYNTHS]; +static struct spk_synth *synths[MAXSYNTHS + 1]; struct spk_synth *synth; char spk_pitch_buff[32] = ""; static int module_status;