Nouveau - Dec 2009 - [PATCH] drm/nouveau: fix array overflow

Noticed by sparse: in nouveau_dp_link_train(), the array 'status' was
defined as 2 bytes, yet it was accessed for 3 bytes.

Fix it by making the array size 3.

Signed-off-by: Pekka Paalanen <pq at iki.fi>
---
 drivers/gpu/drm/nouveau/nouveau_dp.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_dp.c
b/drivers/gpu/drm/nouveau/nouveau_dp.c
index a334f17..c2d6eff 100644
--- a/drivers/gpu/drm/nouveau/nouveau_dp.c
+++ b/drivers/gpu/drm/nouveau/nouveau_dp.c
@@ -271,7 +271,8 @@ nouveau_dp_link_train(struct drm_encoder *encoder)
 {
 	struct drm_device *dev = encoder->dev;
 	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
-	uint8_t config[4], status[2];
+	uint8_t config[4];
+	uint8_t status[3];
 	bool cr_done, cr_max_vs, eq_done;
 	int ret = 0, i, tries, voltage;
 
-- 
1.6.4.4

On Sat, 2009-12-05 at 18:42 +0200, Pekka Paalanen wrote:
> Noticed by sparse: in nouveau_dp_link_train(), the array 'status'
was
> defined as 2 bytes, yet it was accessed for 3 bytes.
> 
> Fix it by making the array size 3.
Thanks, pushed.  Though, for obvious things like this just commit
away :)

Ben.
> 
> Signed-off-by: Pekka Paalanen <pq at iki.fi>
> ---
>  drivers/gpu/drm/nouveau/nouveau_dp.c |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/gpu/drm/nouveau/nouveau_dp.c
b/drivers/gpu/drm/nouveau/nouveau_dp.c
> index a334f17..c2d6eff 100644
> --- a/drivers/gpu/drm/nouveau/nouveau_dp.c
> +++ b/drivers/gpu/drm/nouveau/nouveau_dp.c
> @@ -271,7 +271,8 @@ nouveau_dp_link_train(struct drm_encoder *encoder)
>  {
>  	struct drm_device *dev = encoder->dev;
>  	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
> -	uint8_t config[4], status[2];
> +	uint8_t config[4];
> +	uint8_t status[3];
>  	bool cr_done, cr_max_vs, eq_done;
>  	int ret = 0, i, tries, voltage;
>