redonkable/alistair23-linux
redonkable/alistair23-linux
1
0
Fork 0
Code Releases Activity

Staging: ced1401: fix a couple off by one checks

Browse source 
nArea is used as an offset into the ->rTransDef[] array which has
MAX_TRANSAREAS elements.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2012-09-20 11:43:54 +03:00 committed by Greg Kroah-Hartman
parent bff6c3e00c
commit 428ed14f36
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
drivers/staging/ced1401/ced_ioc.c
View file

@ -837,7 +837,7 @@ int SetEvent(DEVICE_EXTENSION * pdx, TRANSFEREVENT __user * pTE)
int WaitEvent(DEVICE_EXTENSION * pdx, int nArea, int msTimeOut)
{
int iReturn;
if ((unsigned)nArea > MAX_TRANSAREAS)
if ((unsigned)nArea >= MAX_TRANSAREAS)
return U14ERR_BADAREA;
else {
int iWait;
@ -884,7 +884,7 @@ int WaitEvent(DEVICE_EXTENSION * pdx, int nArea, int msTimeOut)
int TestEvent(DEVICE_EXTENSION * pdx, int nArea)
{
int iReturn;
if ((unsigned)nArea > MAX_TRANSAREAS)
if ((unsigned)nArea >= MAX_TRANSAREAS)
iReturn = U14ERR_BADAREA;
else {
TRANSAREA *pTA = &pdx->rTransDef[nArea];