From roel.kluin@gmail.com Thu Aug 13 16:49:04 2009 From: Roel Kluin Date: Sat, 08 Aug 2009 00:14:20 +0200 Subject: Staging: comedi: s626: Possible read buffer overflow fix To: Greg Kroah-Hartman , wfp5p@virginia.edu, devel@driverdev.osuosl.org, Andrew Morton Message-ID: <4A7CA73C.7090607@gmail.com> If `cmd->chanlist_len' is 0, then we write ppl[-1]. Signed-off-by: Roel Kluin Signed-off-by: Greg Kroah-Hartman --- drivers/staging/comedi/drivers/s626.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/staging/comedi/drivers/s626.c +++ b/drivers/staging/comedi/drivers/s626.c @@ -1707,7 +1707,8 @@ static int s626_ai_load_polllist(uint8_t else ppl[n] = (CR_CHAN((cmd->chanlist)[n])) | (RANGE_10V); } - ppl[n - 1] |= EOPL; + if (n != 0) + ppl[n - 1] |= EOPL; return n; }