Staging: ft1000-usb: fix array overflow
The code here is supposed checking if we exited the loop without hitting a break. The problem is that in the error handling "i" is out of bounds and it corrupts memory when we do an info->app_info[i].nRxMsgMiss++. >From the comments, it looks like someone noticed this corruption and updated the code, but didn't totally fix the problem. The correct fix is just to remove nRxMsgMiss++ from the error path. I believe this bug can be triggered remotely. Signed-off-by:Dan Carpenter <error27@gmail.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@suse.de>
Showing
Please register or sign in to comment