From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 26 Feb 2013 19:15:02 +0000 (+0000)
Subject: irda: small read beyond end of array in debug code
X-Git-Tag: accepted/tizen/common/20141203.182822~2711^2~30
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=90c7881ecee1f08e0a49172cf61371cf2509ee4a;p=platform%2Fkernel%2Flinux-arm64.git

irda: small read beyond end of array in debug code

charset comes from skb->data.  It's a number in the 0-255 range.
If we have debugging turned on then this could cause a read beyond
the end of the array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index e71e85b..29340a9 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -495,8 +495,11 @@ static void iriap_getvaluebyclass_confirm(struct iriap_cb *self,
 /*		case CS_ISO_8859_9: */
 /*		case CS_UNICODE: */
 		default:
-			IRDA_DEBUG(0, "%s(), charset %s, not supported\n",
-				   __func__, ias_charset_types[charset]);
+			IRDA_DEBUG(0, "%s(), charset [%d] %s, not supported\n",
+				   __func__, charset,
+				   charset < ARRAY_SIZE(ias_charset_types) ?
+					ias_charset_types[charset] :
+					"(unknown)");
 
 			/* Aborting, close connection! */
 			iriap_disconnect_request(self);