---

yaml --- r: 288966 b: refs/heads/master c: b71dbbc h: refs/heads/master v: v3
git-mirror · Feb 9, 2012 · c0e48a7 · c0e48a7
1 parent 26e1fca
commit c0e48a7
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/[refs] b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 3c92e38dc4d803a7f90a08277a9d59f920963e0c
+refs/heads/master: b71dbbcfaa2a2965e0797db7333396a71062a341
diff --git a/trunk/drivers/staging/bcm/Bcmchar.c b/trunk/drivers/staging/bcm/Bcmchar.c
@@ -1302,8 +1302,10 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)
 		/*
 		 * Deny the access if the offset crosses the cal area limit.
 		 */
+		if (stNVMReadWrite.uiNumBytes > Adapter->uiNVMDSDSize)
+			return STATUS_FAILURE;
 
-		if ((stNVMReadWrite.uiOffset + stNVMReadWrite.uiNumBytes) > Adapter->uiNVMDSDSize) {
+		if (stNVMReadWrite.uiOffset > Adapter->uiNVMDSDSize - stNVMReadWrite.uiNumBytes) {
 			/* BCM_DEBUG_PRINT(Adapter,DBG_TYPE_PRINTK, 0, 0,"Can't allow access beyond NVM Size: 0x%x 0x%x\n", stNVMReadWrite.uiOffset, stNVMReadWrite.uiNumBytes); */
 			return STATUS_FAILURE;
 		}