Commit fc9ca48e authored by Peter Huewe's avatar Peter Huewe Committed by Greg Kroah-Hartman
Browse files

staging/comedi: Fix undefined array subscript 



In vmk80xx_do_insn_bits the local variable reg, which is used as an
index to the tx_buf array, can be used uninitialized if
- data[0] == 0
and
- devpriv->model != VMK8061_MODEL
-> we get into the else branch without having reg initialized.

Since the driver usually differentiates between VMK8061_MODEL and
VMK8055_MODEL it's safe to assume that VMK8055_DO_REG was meant as an
initial value.

And to avoid duplication we can move the assignments to the top.

Acked-by: default avatarIan Abbott <abbotti@mev.co.uk>
Acked-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarPeter Huewe <peterhuewe@gmx.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b7e67242

drivers/staging/comedi/drivers/vmk80xx.c

+7 −10
Original line number Diff line number Diff line
@@ -675,8 +675,14 @@ static int vmk80xx_do_insn_bits(struct comedi_device *dev, 
	if (data[0])

		dir |= DIR_OUT;



	if (devpriv->model == VMK8061_MODEL)

	if (devpriv->model == VMK8061_MODEL) {

		dir |= DIR_IN;

		reg = VMK8061_DO_REG;

		cmd = VMK8061_CMD_DO;

	} else { /* VMK8055_MODEL */

		reg = VMK8055_DO_REG;

		cmd = VMK8055_CMD_WRT_AD;

	}



	retval = rudimentary_check(devpriv, dir);

	if (retval)
@@ -688,14 +694,6 @@ static int vmk80xx_do_insn_bits(struct comedi_device *dev, 
	tx_buf = devpriv->usb_tx_buf;



	if (data[0]) {

		if (devpriv->model == VMK8055_MODEL) {

			reg = VMK8055_DO_REG;

			cmd = VMK8055_CMD_WRT_AD;

		} else { /* VMK8061_MODEL */

			reg = VMK8061_DO_REG;

			cmd = VMK8061_CMD_DO;

		}



		tx_buf[reg] &= ~data[0];

		tx_buf[reg] |= (data[0] & data[1]);
@@ -706,7 +704,6 @@ static int vmk80xx_do_insn_bits(struct comedi_device *dev, 
	}



	if (devpriv->model == VMK8061_MODEL) {

		reg = VMK8061_DO_REG;

		tx_buf[0] = VMK8061_CMD_RD_DO;



		retval = vmk80xx_read_packet(devpriv);