korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-11 21:38:32 +08:00
Code Issues Packages Projects Releases Wiki Activity

[POWERPC] hvcbeat: Fix buffer manipulation

Browse Source 
This fixes a potential bug at drivers/char/hvc_beat.c.
 - hvc_put_term_char routine will decrement "rest" variable twice,
   and forget to advance "buf" pointer by "nlen" bytes.
This bug was not hit previously because the output handler in
drivers/char/hvc_console.c splits given output into 16 bytes
at maximum.

Reported-by: Timur Tabi <timur@freescale.com>
Signed-off-by: Kou Ishizaki <kou.ishizaki@toshiba.co.jp>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Paul Mackerras <paulus@samba.org>
This commit is contained in:
Ishizaki Kou 2008-03-17 21:05:18 +11:00 committed by Paul Mackerras
parent 2fe37a6ec9
commit 55045d47d7
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/char/hvc_beat.c
View File

@ -78,8 +78,8 @@ static int hvc_beat_put_chars(uint32_t vtermno, const char *buf, int cnt)
for (rest = cnt; rest > 0; rest -= nlen) { for (rest = cnt; rest > 0; rest -= nlen) {
nlen = (rest > 16) ? 16 : rest; nlen = (rest > 16) ? 16 : rest;
memcpy(kb, buf, nlen); memcpy(kb, buf, nlen);
beat_put_term_char(vtermno, rest, kb[0], kb[1]); beat_put_term_char(vtermno, nlen, kb[0], kb[1]);
rest -= nlen; buf += nlen;
} }
return cnt; return cnt;
} }