Browse Source

uwb: handle radio controller events with out-of-range IDs correctly

If a radio controller event has an ID that's just out of range don't
read beyond the end of uwbd's event arrays.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David Vrabel <david.vrabel@csr.com>
David Vrabel 16 years ago
parent
commit
3fafdd7cc8
1 changed files with 2 additions and 2 deletions
  1. 2 2
      drivers/uwb/uwbd.c

+ 2 - 2
drivers/uwb/uwbd.c

@@ -187,12 +187,12 @@ int uwbd_event_handle_urc(struct uwb_event *evt)
 	event = le16_to_cpu(evt->notif.rceb->wEvent);
 	context = evt->notif.rceb->bEventContext;
 
-	if (type > ARRAY_SIZE(uwbd_urc_evt_type_handlers))
+	if (type >= ARRAY_SIZE(uwbd_urc_evt_type_handlers))
 		goto out;
 	type_table = &uwbd_urc_evt_type_handlers[type];
 	if (type_table->uwbd_events == NULL)
 		goto out;
-	if (event > type_table->size)
+	if (event >= type_table->size)
 		goto out;
 	handler = type_table->uwbd_events[event].handler;
 	if (handler == NULL)