]> pilppa.com Git - linux-2.6-omap-h63xx.git/commitdiff
[POWERPC] hvcbeat: Fix buffer manipulation
authorIshizaki Kou <kou.ishizaki@toshiba.co.jp>
Mon, 17 Mar 2008 10:05:18 +0000 (21:05 +1100)
committerPaul Mackerras <paulus@samba.org>
Wed, 16 Apr 2008 21:46:10 +0000 (07:46 +1000)
This fixes a potential bug at drivers/char/hvc_beat.c.
 - hvc_put_term_char routine will decrement "rest" variable twice,
   and forget to advance "buf" pointer by "nlen" bytes.
This bug was not hit previously because the output handler in
drivers/char/hvc_console.c splits given output into 16 bytes
at maximum.

Reported-by: Timur Tabi <timur@freescale.com>
Signed-off-by: Kou Ishizaki <kou.ishizaki@toshiba.co.jp>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Paul Mackerras <paulus@samba.org>
drivers/char/hvc_beat.c

index e74bb949c289b30e2d43d30e9a19b9583a359400..91cdb35a920480f384fdff9efad6f28fb572021f 100644 (file)
@@ -78,8 +78,8 @@ static int hvc_beat_put_chars(uint32_t vtermno, const char *buf, int cnt)
        for (rest = cnt; rest > 0; rest -= nlen) {
                nlen = (rest > 16) ? 16 : rest;
                memcpy(kb, buf, nlen);
-               beat_put_term_char(vtermno, rest, kb[0], kb[1]);
-               rest -= nlen;
+               beat_put_term_char(vtermno, nlen, kb[0], kb[1]);
+               buf += nlen;
        }
        return cnt;
 }