[Nouveau] [PATCH] drm/nouveau: fix array overflow

Pekka Paalanen pq at iki.fi
Sat Dec 5 08:42:11 PST 2009


Noticed by sparse: in nouveau_dp_link_train(), the array 'status' was
defined as 2 bytes, yet it was accessed for 3 bytes.

Fix it by making the array size 3.

Signed-off-by: Pekka Paalanen <pq at iki.fi>
---
 drivers/gpu/drm/nouveau/nouveau_dp.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_dp.c b/drivers/gpu/drm/nouveau/nouveau_dp.c
index a334f17..c2d6eff 100644
--- a/drivers/gpu/drm/nouveau/nouveau_dp.c
+++ b/drivers/gpu/drm/nouveau/nouveau_dp.c
@@ -271,7 +271,8 @@ nouveau_dp_link_train(struct drm_encoder *encoder)
 {
 	struct drm_device *dev = encoder->dev;
 	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
-	uint8_t config[4], status[2];
+	uint8_t config[4];
+	uint8_t status[3];
 	bool cr_done, cr_max_vs, eq_done;
 	int ret = 0, i, tries, voltage;
 
-- 
1.6.4.4



More information about the Nouveau mailing list