mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-27 14:45:19 +00:00
Staging: ced1401: fix a couple off by one checks
nArea is used as an offset into the ->rTransDef[] array which has MAX_TRANSAREAS elements. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
bff6c3e00c
commit
428ed14f36
1 changed files with 2 additions and 2 deletions
|
@ -837,7 +837,7 @@ int SetEvent(DEVICE_EXTENSION * pdx, TRANSFEREVENT __user * pTE)
|
|||
int WaitEvent(DEVICE_EXTENSION * pdx, int nArea, int msTimeOut)
|
||||
{
|
||||
int iReturn;
|
||||
if ((unsigned)nArea > MAX_TRANSAREAS)
|
||||
if ((unsigned)nArea >= MAX_TRANSAREAS)
|
||||
return U14ERR_BADAREA;
|
||||
else {
|
||||
int iWait;
|
||||
|
@ -884,7 +884,7 @@ int WaitEvent(DEVICE_EXTENSION * pdx, int nArea, int msTimeOut)
|
|||
int TestEvent(DEVICE_EXTENSION * pdx, int nArea)
|
||||
{
|
||||
int iReturn;
|
||||
if ((unsigned)nArea > MAX_TRANSAREAS)
|
||||
if ((unsigned)nArea >= MAX_TRANSAREAS)
|
||||
iReturn = U14ERR_BADAREA;
|
||||
else {
|
||||
TRANSAREA *pTA = &pdx->rTransDef[nArea];
|
||||
|
|
Loading…
Reference in a new issue