Input: atkbd - fix overrun in atkbd_set_repeat_rate()
authorFlorin Malita <fmalita@gmail.com>
Wed, 23 Aug 2006 04:45:33 +0000 (00:45 -0400)
committerDmitry Torokhov <dtor@insightbb.com>
Wed, 23 Aug 2006 04:45:33 +0000 (00:45 -0400)
This was introduced in commit 3d0f0fa0cb554541e10cb8cb84104e4b10828468:
bounds checking is performed against period[32] while indexing delay[4].

Spotted by Coverity, CID 1376.

Signed-off-by: Florin Malita <fmalita@gmail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
drivers/input/keyboard/atkbd.c

index 6bfa0cf4b1d2db2cf7ace5f90ceb39f955c23398..a86afd0a5ef13c95c869613c5fd4e67b7c414825 100644 (file)
@@ -498,7 +498,7 @@ static int atkbd_set_repeat_rate(struct atkbd *atkbd)
                i++;
        dev->rep[REP_PERIOD] = period[i];
 
-       while (j < ARRAY_SIZE(period) - 1 && delay[j] < dev->rep[REP_DELAY])
+       while (j < ARRAY_SIZE(delay) - 1 && delay[j] < dev->rep[REP_DELAY])
                j++;
        dev->rep[REP_DELAY] = delay[j];