cxt1e1: Buffer access out of bounds

Thomas Jarosch thomas.jarosch at intra2net.com
Sun Oct 16 09:15:30 UTC 2011


Hi,

while fooling around with "cppcheck" on the kernel tree,
it detected this:

[drivers/staging/cxt1e1/comet.c:415]: (error) Array 'table[24][5]' index table[24][0] out of bounds

The code in staging looks like this:
STATIC void
WrtXmtWaveformTbl (ci_t * ci, comet_t * comet,
                   u_int8_t table[COMET_NUM_SAMPLES][COMET_NUM_UNITS])
{
    ...

    /* Enable transmitter and set output amplitude */
    pci_write_32 ((u_int32_t *) &comet->xlpg_cfg, table[COMET_NUM_SAMPLES][0]);
}

-> The array is of size COMET_NUM_SAMPLES, so the highest index
should be COMET_NUM_SAMPLES-1.

Though I'm unsure about the correct fix, I'm not familiar with this code.

Please CC: comments.

Cheers,
Thomas



More information about the devel mailing list