Commit:     84ea77635b91a6ca1c0c592ee5ddc0c780856b97
Parent:     a12bb44471b819c7f33d8a83044e7116c124e3d5
Author:     Eric Sesterhenn / Snakebyte <[EMAIL PROTECTED]>
AuthorDate: Thu May 10 22:22:48 2007 -0700
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Fri May 11 08:29:34 2007 -0700

    Overrun in drivers/char/rio/riocmd.c
    This got somehow lost in the noise.  This fixes coverity bug id #1025, if
    Rup is greater or equal to MAX_RUP, we run past the Mapping Array.
    Signed-off-by: Eric Sesterhenn <[EMAIL PROTECTED]>
    Cc: Jiri Slaby <[EMAIL PROTECTED]>
    Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
 drivers/char/rio/riocmd.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/char/rio/riocmd.c b/drivers/char/rio/riocmd.c
index 245f031..8cc60b6 100644
--- a/drivers/char/rio/riocmd.c
+++ b/drivers/char/rio/riocmd.c
@@ -402,7 +402,7 @@ static int RIOCommandRup(struct rio_info *p, uint Rup, 
struct Host *HostP, struc
                rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: Host number 
%Zd, name ``%s''\n", HostP - p->RIOHosts, HostP->Name);
                rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: Rup number  
0x%x\n", rup);
-               if (Rup >= (unsigned short) MAX_RUP) {
+               if (Rup < (unsigned short) MAX_RUP) {
                        rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: This 
is the RUP for RTA ``%s''\n", HostP->Mapping[Rup].Name);
                } else
                        rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: This 
is the RUP for link ``%c'' of host ``%s''\n", ('A' + Rup - MAX_RUP), 
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to