From 4ff863b1db411481971de481002aa644057b1fa6 Mon Sep 17 00:00:00 2001 From: Roel Kluin Date: Sat, 8 Aug 2009 00:14:20 +0200 Subject: [PATCH] Staging: comedi: s626: Possible read buffer overflow fix If `cmd->chanlist_len' is 0, then we write ppl[-1]. Signed-off-by: Roel Kluin Signed-off-by: Greg Kroah-Hartman --- drivers/staging/comedi/drivers/s626.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/staging/comedi/drivers/s626.c b/drivers/staging/comedi/drivers/s626.c index 6549d116f2e6..80d2787d1063 100644 --- a/drivers/staging/comedi/drivers/s626.c +++ b/drivers/staging/comedi/drivers/s626.c @@ -1707,7 +1707,8 @@ static int s626_ai_load_polllist(uint8_t * ppl, struct comedi_cmd *cmd) else ppl[n] = (CR_CHAN((cmd->chanlist)[n])) | (RANGE_10V); } - ppl[n - 1] |= EOPL; + if (n != 0) + ppl[n - 1] |= EOPL; return n; } -- 2.30.2