mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-24 17:23:25 -05:00
Code Activity

isdn/kcapi: fix a small underflow

Browse source 
In get_capi_ctr_by_nr() and get_capi_appl_by_nr() the parameter comes
from skb->data.  The current code can underflow to one space before the
start of the array.

The sanity check isn't needed in __get_capi_appl_by_nr() but I changed
it to match the others.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Dan Carpenter 2013-05-19 08:36:36 +00:00 • committed by David S. Miller
parent 057cf65e4f
commit 25dff94ff9
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/isdn/capi/kcapi.c
View file

@ -93,7 +93,7 @@ capi_ctr_put(struct capi_ctr *ctr)
static inline struct capi_ctr *get_capi_ctr_by_nr(u16 contr) static inline struct capi_ctr *get_capi_ctr_by_nr(u16 contr)
{ {
if (contr - 1 >= CAPI_MAXCONTR) if (contr < 1 || contr - 1 >= CAPI_MAXCONTR)
return NULL; return NULL;
return capi_controller[contr - 1]; return capi_controller[contr - 1];
@ -103,7 +103,7 @@ static inline struct capi20_appl *__get_capi_appl_by_nr(u16 applid)
{ {
lockdep_assert_held(&capi_controller_lock); lockdep_assert_held(&capi_controller_lock);
if (applid - 1 >= CAPI_MAXAPPL) if (applid < 1 || applid - 1 >= CAPI_MAXAPPL)
return NULL; return NULL;
return capi_applications[applid - 1]; return capi_applications[applid - 1];
@ -111,7 +111,7 @@ static inline struct capi20_appl *__get_capi_appl_by_nr(u16 applid)
static inline struct capi20_appl *get_capi_appl_by_nr(u16 applid) static inline struct capi20_appl *get_capi_appl_by_nr(u16 applid)
{ {
if (applid - 1 >= CAPI_MAXAPPL) if (applid < 1 || applid - 1 >= CAPI_MAXAPPL)
return NULL; return NULL;
return rcu_dereference(capi_applications[applid - 1]); return rcu_dereference(capi_applications[applid - 1]);