提交 d5ce1379 编写于 作者: E Eric Sesterhenn 提交者: Greg Kroah-Hartman

[PATCH] USB: negative index in drivers/usb/host/isp116x-hcd.c

From: Eric Sesterhenn <snakebyte@gmx.de>

This fixes coverity Bug #390.

With the following code

	ret = ep->branch = balance(isp116x, ep->period, ep->load);
	if (ret < 0)
		goto fail;

the problem is that ret and balance are of the type int, and ep->branch is u16.
so the int balance() returns gets reduced to u16 and then converted to an int again,
which removes the sign. Maybe the following little c program can explain it better:
上级 b10cee9d
...@@ -781,7 +781,7 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd, ...@@ -781,7 +781,7 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd,
if (ep->branch < PERIODIC_SIZE) if (ep->branch < PERIODIC_SIZE)
break; break;
ret = ep->branch = balance(isp116x, ep->period, ep->load); ep->branch = ret = balance(isp116x, ep->period, ep->load);
if (ret < 0) if (ret < 0)
goto fail; goto fail;
ret = 0; ret = 0;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册