From c0e48a7e0489fd4a7b220d9274a1c86049ccdecd Mon Sep 17 00:00:00 2001 From: Kevin McKinney Date: Tue, 20 Dec 2011 10:41:13 -0500 Subject: [PATCH] --- yaml --- r: 288966 b: refs/heads/master c: b71dbbcfaa2a2965e0797db7333396a71062a341 h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/drivers/staging/bcm/Bcmchar.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/[refs] b/[refs] index 3178411427ef..e7622ac8987f 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 3c92e38dc4d803a7f90a08277a9d59f920963e0c +refs/heads/master: b71dbbcfaa2a2965e0797db7333396a71062a341 diff --git a/trunk/drivers/staging/bcm/Bcmchar.c b/trunk/drivers/staging/bcm/Bcmchar.c index 179707b5e7c7..8bf3f575160f 100644 --- a/trunk/drivers/staging/bcm/Bcmchar.c +++ b/trunk/drivers/staging/bcm/Bcmchar.c @@ -1302,8 +1302,10 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg) /* * Deny the access if the offset crosses the cal area limit. */ + if (stNVMReadWrite.uiNumBytes > Adapter->uiNVMDSDSize) + return STATUS_FAILURE; - if ((stNVMReadWrite.uiOffset + stNVMReadWrite.uiNumBytes) > Adapter->uiNVMDSDSize) { + if (stNVMReadWrite.uiOffset > Adapter->uiNVMDSDSize - stNVMReadWrite.uiNumBytes) { /* BCM_DEBUG_PRINT(Adapter,DBG_TYPE_PRINTK, 0, 0,"Can't allow access beyond NVM Size: 0x%x 0x%x\n", stNVMReadWrite.uiOffset, stNVMReadWrite.uiNumBytes); */ return STATUS_FAILURE; }