mtd: intflmount: fix off by one error in INFTL_dumpVUchains()
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 21 Oct 2014 08:08:35 +0000 (11:08 +0300)
committerBrian Norris <computersforpeace@gmail.com>
Wed, 5 Nov 2014 21:19:21 +0000 (13:19 -0800)
The ->PUtable[] array has "->nb_blocks" number of elemetns so this
comparison should be ">=" instead of ">".  Otherwise it could result in
a minor read beyond the end of an array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
drivers/mtd/inftlmount.c

index 487e64f..1388c8d 100644 (file)
@@ -518,7 +518,7 @@ void INFTL_dumpVUchains(struct INFTLrecord *s)
        pr_debug("INFTL Virtual Unit Chains:\n");
        for (logical = 0; logical < s->nb_blocks; logical++) {
                block = s->VUtable[logical];
-               if (block > s->nb_blocks)
+               if (block >= s->nb_blocks)
                        continue;
                pr_debug("  LOGICAL %d --> %d ", logical, block);
                for (i = 0; i < s->nb_blocks; i++) {