From: Ishizaki Kou Date: Mon, 17 Mar 2008 10:05:18 +0000 (+1100) Subject: [POWERPC] hvcbeat: Fix buffer manipulation X-Git-Tag: v2.6.26-rc1~1125^2~42 X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=55045d47d7a8c4c61bc0ca6f2fac5087dd598bc3;p=linux-2.6-omap-h63xx.git [POWERPC] hvcbeat: Fix buffer manipulation This fixes a potential bug at drivers/char/hvc_beat.c. - hvc_put_term_char routine will decrement "rest" variable twice, and forget to advance "buf" pointer by "nlen" bytes. This bug was not hit previously because the output handler in drivers/char/hvc_console.c splits given output into 16 bytes at maximum. Reported-by: Timur Tabi Signed-off-by: Kou Ishizaki Acked-by: Arnd Bergmann Signed-off-by: Paul Mackerras --- diff --git a/drivers/char/hvc_beat.c b/drivers/char/hvc_beat.c index e74bb949c28..91cdb35a920 100644 --- a/drivers/char/hvc_beat.c +++ b/drivers/char/hvc_beat.c @@ -78,8 +78,8 @@ static int hvc_beat_put_chars(uint32_t vtermno, const char *buf, int cnt) for (rest = cnt; rest > 0; rest -= nlen) { nlen = (rest > 16) ? 16 : rest; memcpy(kb, buf, nlen); - beat_put_term_char(vtermno, rest, kb[0], kb[1]); - rest -= nlen; + beat_put_term_char(vtermno, nlen, kb[0], kb[1]); + buf += nlen; } return cnt; }