Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 428ed14f authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

Staging: ced1401: fix a couple off by one checks 



nArea is used as an offset into the ->rTransDef[] array which has
MAX_TRANSAREAS elements.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent bff6c3e0

drivers/staging/ced1401/ced_ioc.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -837,7 +837,7 @@ int SetEvent(DEVICE_EXTENSION * pdx, TRANSFEREVENT __user * pTE) 
int WaitEvent(DEVICE_EXTENSION * pdx, int nArea, int msTimeOut)

int WaitEvent(DEVICE_EXTENSION * pdx, int nArea, int msTimeOut)

{

{

	int iReturn;

	int iReturn;

	if ((unsigned)nArea > MAX_TRANSAREAS)

	if ((unsigned)nArea >= MAX_TRANSAREAS)

		return U14ERR_BADAREA;

		return U14ERR_BADAREA;

	else {

	else {

		int iWait;

		int iWait;
@@ -884,7 +884,7 @@ int WaitEvent(DEVICE_EXTENSION * pdx, int nArea, int msTimeOut) 
int TestEvent(DEVICE_EXTENSION * pdx, int nArea)

int TestEvent(DEVICE_EXTENSION * pdx, int nArea)

{

{

	int iReturn;

	int iReturn;

	if ((unsigned)nArea > MAX_TRANSAREAS)

	if ((unsigned)nArea >= MAX_TRANSAREAS)

		iReturn = U14ERR_BADAREA;

		iReturn = U14ERR_BADAREA;

	else {

	else {

		TRANSAREA *pTA = &pdx->rTransDef[nArea];

		TRANSAREA *pTA = &pdx->rTransDef[nArea];