uwb: handle radio controller events with out-of-range IDs correctly
authorDavid Vrabel <david.vrabel@csr.com>
Tue, 25 Aug 2009 14:03:07 +0000 (15:03 +0100)
committerDavid Vrabel <david.vrabel@csr.com>
Tue, 25 Aug 2009 14:03:07 +0000 (15:03 +0100)
If a radio controller event has an ID that's just out of range don't
read beyond the end of uwbd's event arrays.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David Vrabel <david.vrabel@csr.com>
drivers/uwb/uwbd.c

index 57bd6bfef37e95cca10ec3c2133e7f19f7d7c28a..5a777d8624da3f791bc08c2228de6b256a6d3bdc 100644 (file)
@@ -187,12 +187,12 @@ int uwbd_event_handle_urc(struct uwb_event *evt)
        event = le16_to_cpu(evt->notif.rceb->wEvent);
        context = evt->notif.rceb->bEventContext;
 
-       if (type > ARRAY_SIZE(uwbd_urc_evt_type_handlers))
+       if (type >= ARRAY_SIZE(uwbd_urc_evt_type_handlers))
                goto out;
        type_table = &uwbd_urc_evt_type_handlers[type];
        if (type_table->uwbd_events == NULL)
                goto out;
-       if (event > type_table->size)
+       if (event >= type_table->size)
                goto out;
        handler = type_table->uwbd_events[event].handler;
        if (handler == NULL)