diff options
| author | David Vrabel <david.vrabel@csr.com> | 2009-08-25 15:03:07 +0100 |
|---|---|---|
| committer | David Vrabel <david.vrabel@csr.com> | 2009-08-25 15:03:07 +0100 |
| commit | 3fafdd7cc810a8fcd28b83fbde2d0e25830dee41 (patch) | |
| tree | ad01860283a1ac1a05759a39834fa0b56683f4aa /drivers | |
| parent | 7c0a57d5c47bcfc492b3139e77400f888a935c44 (diff) | |
| download | op-kernel-dev-3fafdd7cc810a8fcd28b83fbde2d0e25830dee41.zip op-kernel-dev-3fafdd7cc810a8fcd28b83fbde2d0e25830dee41.tar.gz | |
uwb: handle radio controller events with out-of-range IDs correctly
If a radio controller event has an ID that's just out of range don't
read beyond the end of uwbd's event arrays.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David Vrabel <david.vrabel@csr.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/uwb/uwbd.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/uwb/uwbd.c b/drivers/uwb/uwbd.c index 57bd6bf..5a777d8 100644 --- a/drivers/uwb/uwbd.c +++ b/drivers/uwb/uwbd.c @@ -187,12 +187,12 @@ int uwbd_event_handle_urc(struct uwb_event *evt) event = le16_to_cpu(evt->notif.rceb->wEvent); context = evt->notif.rceb->bEventContext; - if (type > ARRAY_SIZE(uwbd_urc_evt_type_handlers)) + if (type >= ARRAY_SIZE(uwbd_urc_evt_type_handlers)) goto out; type_table = &uwbd_urc_evt_type_handlers[type]; if (type_table->uwbd_events == NULL) goto out; - if (event > type_table->size) + if (event >= type_table->size) goto out; handler = type_table->uwbd_events[event].handler; if (handler == NULL) |
