diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-05-19 12:36:36 +0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2013-05-21 00:38:14 +0400 |
| commit | 25dff94ff9df40d4d663bb6ea3193a7758cc50e5 (patch) | |
| tree | 2371e9c1dea647c690a2b01255d462656a8393ce /drivers/isdn/capi | |
| parent | 057cf65e4f715f62acccbd9125cf63eddfe69d30 (diff) | |
| download | linux-25dff94ff9df40d4d663bb6ea3193a7758cc50e5.tar.xz | |
isdn/kcapi: fix a small underflow
In get_capi_ctr_by_nr() and get_capi_appl_by_nr() the parameter comes
from skb->data. The current code can underflow to one space before the
start of the array.
The sanity check isn't needed in __get_capi_appl_by_nr() but I changed
it to match the others.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/isdn/capi')
| -rw-r--r-- | drivers/isdn/capi/kcapi.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c index 9b1b274c7d25..c123709acf82 100644 --- a/drivers/isdn/capi/kcapi.c +++ b/drivers/isdn/capi/kcapi.c @@ -93,7 +93,7 @@ capi_ctr_put(struct capi_ctr *ctr) static inline struct capi_ctr *get_capi_ctr_by_nr(u16 contr) { - if (contr - 1 >= CAPI_MAXCONTR) + if (contr < 1 || contr - 1 >= CAPI_MAXCONTR) return NULL; return capi_controller[contr - 1]; @@ -103,7 +103,7 @@ static inline struct capi20_appl *__get_capi_appl_by_nr(u16 applid) { lockdep_assert_held(&capi_controller_lock); - if (applid - 1 >= CAPI_MAXAPPL) + if (applid < 1 || applid - 1 >= CAPI_MAXAPPL) return NULL; return capi_applications[applid - 1]; @@ -111,7 +111,7 @@ static inline struct capi20_appl *__get_capi_appl_by_nr(u16 applid) static inline struct capi20_appl *get_capi_appl_by_nr(u16 applid) { - if (applid - 1 >= CAPI_MAXAPPL) + if (applid < 1 || applid - 1 >= CAPI_MAXAPPL) return NULL; return rcu_dereference(capi_applications[applid - 1]); |