path: root/drivers/uwb/uwbd.c
diff options
authorDavid Vrabel <david.vrabel@csr.com>2009-08-25 15:03:07 +0100
committerDavid Vrabel <david.vrabel@csr.com>2009-08-25 15:03:07 +0100
commit3fafdd7cc810a8fcd28b83fbde2d0e25830dee41 (patch)
treead01860283a1ac1a05759a39834fa0b56683f4aa /drivers/uwb/uwbd.c
parent7c0a57d5c47bcfc492b3139e77400f888a935c44 (diff)
uwb: handle radio controller events with out-of-range IDs correctly
If a radio controller event has an ID that's just out of range don't read beyond the end of uwbd's event arrays. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David Vrabel <david.vrabel@csr.com>
Diffstat (limited to 'drivers/uwb/uwbd.c')
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/uwb/uwbd.c b/drivers/uwb/uwbd.c
index 57bd6bfef37e..5a777d8624da 100644
--- a/drivers/uwb/uwbd.c
+++ b/drivers/uwb/uwbd.c
@@ -187,12 +187,12 @@ int uwbd_event_handle_urc(struct uwb_event *evt)
event = le16_to_cpu(evt->notif.rceb->wEvent);
context = evt->notif.rceb->bEventContext;
- if (type > ARRAY_SIZE(uwbd_urc_evt_type_handlers))
+ if (type >= ARRAY_SIZE(uwbd_urc_evt_type_handlers))
goto out;
type_table = &uwbd_urc_evt_type_handlers[type];
if (type_table->uwbd_events == NULL)
goto out;
- if (event > type_table->size)
+ if (event >= type_table->size)
goto out;
handler = type_table->uwbd_events[event].handler;
if (handler == NULL)

Privacy Policy