diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2024-05-24 17:43:25 +0200 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2024-05-24 17:43:25 +0200 |
| commit | e292ead0c9dad3580cfd45693a59902c8d31a0a7 (patch) | |
| tree | e5f93fbf099931738aaa0c0e9aded25dd1004612 | |
| parent | Merge tag 'tty-6.10-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/g... (diff) | |
| parent | speakup: Fix sizeof() vs ARRAY_SIZE() bug (diff) | |
| download | linux-e292ead0c9dad3580cfd45693a59902c8d31a0a7.tar.xz linux-e292ead0c9dad3580cfd45693a59902c8d31a0a7.zip | |
Merge tag 'char-misc-6.10-rc1-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc fix from Greg KH:
"Here is one remaining bugfix for 6.10-rc1 that missed the 6.9-final
merge window, and has been sitting in my tree and linux-next for quite
a while now, but wasn't sent to you (my fault, travels...)
It is a bugfix to resolve an error in the speakup code that could
overflow a buffer.
It has been in linux-next for a while with no reported problems"
* tag 'char-misc-6.10-rc1-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
speakup: Fix sizeof() vs ARRAY_SIZE() bug
| -rw-r--r-- | drivers/accessibility/speakup/main.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/accessibility/speakup/main.c b/drivers/accessibility/speakup/main.c index 736c2eb8c0f3..f677ad2177c2 100644 --- a/drivers/accessibility/speakup/main.c +++ b/drivers/accessibility/speakup/main.c @@ -574,7 +574,7 @@ static u_long get_word(struct vc_data *vc) } attr_ch = get_char(vc, (u_short *)tmp_pos, &spk_attr); buf[cnt++] = attr_ch; - while (tmpx < vc->vc_cols - 1 && cnt < sizeof(buf) - 1) { + while (tmpx < vc->vc_cols - 1 && cnt < ARRAY_SIZE(buf) - 1) { tmp_pos += 2; tmpx++; ch = get_char(vc, (u_short *)tmp_pos, &temp); |