Browse Source

mtd: intflmount: fix off by one error in INFTL_dumpVUchains()

The ->PUtable[] array has "->nb_blocks" number of elemetns so this
comparison should be ">=" instead of ">".  Otherwise it could result in
a minor read beyond the end of an array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Dan Carpenter 10 năm trước cách đây
mục cha
commit
e8e6c87565
1 tập tin đã thay đổi với 1 bổ sung1 xóa
  1. 1 1
      drivers/mtd/inftlmount.c

+ 1 - 1
drivers/mtd/inftlmount.c

@@ -518,7 +518,7 @@ void INFTL_dumpVUchains(struct INFTLrecord *s)
 	pr_debug("INFTL Virtual Unit Chains:\n");
 	for (logical = 0; logical < s->nb_blocks; logical++) {
 		block = s->VUtable[logical];
-		if (block > s->nb_blocks)
+		if (block >= s->nb_blocks)
 			continue;
 		pr_debug("  LOGICAL %d --> %d ", logical, block);
 		for (i = 0; i < s->nb_blocks; i++) {