diff options
| author | Ishizaki Kou <kou.ishizaki@toshiba.co.jp> | 2008-03-17 13:05:18 +0300 |
|---|---|---|
| committer | Paul Mackerras <paulus@samba.org> | 2008-04-17 01:46:10 +0400 |
| commit | 55045d47d7a8c4c61bc0ca6f2fac5087dd598bc3 (patch) | |
| tree | e2a2c327604d0c521a59a49524655248831412c9 /drivers/char/hvc_beat.c | |
| parent | 2fe37a6ec933ca7332a8ca8d29e87705116afd3a (diff) | |
| download | linux-55045d47d7a8c4c61bc0ca6f2fac5087dd598bc3.tar.xz | |
[POWERPC] hvcbeat: Fix buffer manipulation
This fixes a potential bug at drivers/char/hvc_beat.c.
- hvc_put_term_char routine will decrement "rest" variable twice,
and forget to advance "buf" pointer by "nlen" bytes.
This bug was not hit previously because the output handler in
drivers/char/hvc_console.c splits given output into 16 bytes
at maximum.
Reported-by: Timur Tabi <timur@freescale.com>
Signed-off-by: Kou Ishizaki <kou.ishizaki@toshiba.co.jp>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Diffstat (limited to 'drivers/char/hvc_beat.c')
| -rw-r--r-- | drivers/char/hvc_beat.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/char/hvc_beat.c b/drivers/char/hvc_beat.c index e74bb949c289..91cdb35a9204 100644 --- a/drivers/char/hvc_beat.c +++ b/drivers/char/hvc_beat.c @@ -78,8 +78,8 @@ static int hvc_beat_put_chars(uint32_t vtermno, const char *buf, int cnt) for (rest = cnt; rest > 0; rest -= nlen) { nlen = (rest > 16) ? 16 : rest; memcpy(kb, buf, nlen); - beat_put_term_char(vtermno, rest, kb[0], kb[1]); - rest -= nlen; + beat_put_term_char(vtermno, nlen, kb[0], kb[1]); + buf += nlen; } return cnt; } |