FEX-Emu/linux
1
0
Fork 0
mirror of https://github.com/FEX-Emu/linux.git synced 2025-01-08 18:42:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Staging: rts5139: a couple off by one fixes

Browse Source 
Inside the array we check ms_start_idx[seg_no + 1] so on the last round
through we end up going past the end of the array.

Also if we don't break out of the loop early then we are beyond the end
of the array there as well.  With this change, if we don't find what we
are looking for, we end on the last element of the array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2012-03-29 21:52:20 +03:00 committed by Greg Kroah-Hartman
parent fc44de0097
commit 2471ec5895
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/staging/rts5139/ms.c
View File

@ -3864,7 +3864,7 @@ static int ms_rw_multi_sector(struct scsi_cmnd *srb, struct rts51x_chip *chip,
log_blk = (u16) (start_sector >> ms_card->block_shift);
start_page = (u8) (start_sector & ms_card->page_off);
for (seg_no = 0; seg_no < sizeof(ms_start_idx) / 2; seg_no++) {
for (seg_no = 0; seg_no < ARRAY_SIZE(ms_start_idx) - 1; seg_no++) {
if (log_blk < ms_start_idx[seg_no + 1])
break;
}
@ -4020,7 +4020,8 @@ static int ms_rw_multi_sector(struct scsi_cmnd *srb, struct rts51x_chip *chip,
log_blk++;
for (seg_no = 0; seg_no < sizeof(ms_start_idx) / 2; seg_no++) {
for (seg_no = 0; seg_no < ARRAY_SIZE(ms_start_idx) - 1;
seg_no++) {
if (log_blk < ms_start_idx[seg_no + 1])
break;
}