From 55045d47d7a8c4c61bc0ca6f2fac5087dd598bc3 Mon Sep 17 00:00:00 2001 From: Ishizaki Kou Date: Mon, 17 Mar 2008 21:05:18 +1100 Subject: [POWERPC] hvcbeat: Fix buffer manipulation This fixes a potential bug at drivers/char/hvc_beat.c. - hvc_put_term_char routine will decrement "rest" variable twice, and forget to advance "buf" pointer by "nlen" bytes. This bug was not hit previously because the output handler in drivers/char/hvc_console.c splits given output into 16 bytes at maximum. Reported-by: Timur Tabi Signed-off-by: Kou Ishizaki Acked-by: Arnd Bergmann Signed-off-by: Paul Mackerras --- drivers/char/hvc_beat.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/char/hvc_beat.c') diff --git a/drivers/char/hvc_beat.c b/drivers/char/hvc_beat.c index e74bb949c28..91cdb35a920 100644 --- a/drivers/char/hvc_beat.c +++ b/drivers/char/hvc_beat.c @@ -78,8 +78,8 @@ static int hvc_beat_put_chars(uint32_t vtermno, const char *buf, int cnt) for (rest = cnt; rest > 0; rest -= nlen) { nlen = (rest > 16) ? 16 : rest; memcpy(kb, buf, nlen); - beat_put_term_char(vtermno, rest, kb[0], kb[1]); - rest -= nlen; + beat_put_term_char(vtermno, nlen, kb[0], kb[1]); + buf += nlen; } return cnt; } -- cgit v1.2.3