Skip to content

Commit

Permalink
uwb: handle radio controller events with out-of-range IDs correctly
Browse files Browse the repository at this point in the history
If a radio controller event has an ID that's just out of range don't
read beyond the end of uwbd's event arrays.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David Vrabel <david.vrabel@csr.com>
  • Loading branch information
David Vrabel committed Aug 25, 2009
1 parent 7c0a57d commit 3fafdd7
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions drivers/uwb/uwbd.c
Original file line number Diff line number Diff line change
Expand Up @@ -187,12 +187,12 @@ int uwbd_event_handle_urc(struct uwb_event *evt)
event = le16_to_cpu(evt->notif.rceb->wEvent);
context = evt->notif.rceb->bEventContext;

if (type > ARRAY_SIZE(uwbd_urc_evt_type_handlers))
if (type >= ARRAY_SIZE(uwbd_urc_evt_type_handlers))
goto out;
type_table = &uwbd_urc_evt_type_handlers[type];
if (type_table->uwbd_events == NULL)
goto out;
if (event > type_table->size)
if (event >= type_table->size)
goto out;
handler = type_table->uwbd_events[event].handler;
if (handler == NULL)
Expand Down

0 comments on commit 3fafdd7

Please sign in to comment.