staging: comedi: ni_usb6501: fix possible out-of-bounds access
authorH Hartley Sweeten <hsweeten@visionengravers.com>
Mon, 10 Aug 2015 17:28:08 +0000 (10:28 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 15 Aug 2015 00:33:22 +0000 (17:33 -0700)
commit365741e6a6ab7f31ff885c26dd173d9590d1e8ca
tree1823419b5cacddd66f66c056ee1fd78d23c5f84d
parent1c46ae0af6df0bbde66c5e868563be57f18a27b4
staging: comedi: ni_usb6501: fix possible out-of-bounds access

Coverity reports a possible Out-of-bounds access (ARRAY_VS_SINGLETON)
with the 'const u8 *port' parameter passed to ni6501_port_command().
This param is an actual array for the SET_PORT_DIR operation, called
by ni6501_dio_insn_config(). But for the WRITE_PORT and READ_PORT
operations, called by ni6501_dio_insn_bits(), it is just the address
of an u8 local variable.

Fix the coverity issue by changing the parameter to an unsigned int
and pass the raw values from ni6501_dio_insn_config() and
ni6501_dio_insn_bits(). ni6501_port_command() then handles the masking
and shifting needed to load the value into the u8 transmit buffer.

For consistency, change the access of the 'bitmap' parameter from an
array access to a pointer operation.

Reported-by: coverity (CID 1248624)
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/comedi/drivers/ni_usb6501.c