Input: atkbd - fix overrun in atkbd_set_repeat_rate()

This was introduced in commit 3d0f0fa0cb554541e10cb8cb84104e4b10828468:
bounds checking is performed against period[32] while indexing delay[4].

Spotted by Coverity, CID 1376.

Signed-off-by: Florin Malita <fmalita@gmail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 6bfa0cf4b1d2db2cf7ace5f90ceb39f955c23398..a86afd0a5ef13c95c869613c5fd4e67b7c414825 100644 (file)
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -498,7 +498,7 @@ static int atkbd_set_repeat_rate(struct atkbd *atkbd)
                i++;
        dev->rep[REP_PERIOD] = period[i];
 
-       while (j < ARRAY_SIZE(period) - 1 && delay[j] < dev->rep[REP_DELAY])
+       while (j < ARRAY_SIZE(delay) - 1 && delay[j] < dev->rep[REP_DELAY])
                j++;
        dev->rep[REP_DELAY] = delay[j];