forked from luck/tmp_suning_uos_patched
gigaset: correct range checking off by one error
Correct a potential array overrun due to an off by one error in the range check on the CAPI CONNECT_REQ CIPValue parameter. Found and reported by Dan Carpenter using smatch. Impact: bugfix Signed-off-by: Tilman Schmidt <tilman@imap.cc> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
7f7708f005
commit
6ad34145cf
|
@ -1301,7 +1301,7 @@ static void do_connect_req(struct gigaset_capi_ctr *iif,
|
|||
}
|
||||
|
||||
/* check parameter: CIP Value */
|
||||
if (cmsg->CIPValue > ARRAY_SIZE(cip2bchlc) ||
|
||||
if (cmsg->CIPValue >= ARRAY_SIZE(cip2bchlc) ||
|
||||
(cmsg->CIPValue > 0 && cip2bchlc[cmsg->CIPValue].bc == NULL)) {
|
||||
dev_notice(cs->dev, "%s: unknown CIP value %d\n",
|
||||
"CONNECT_REQ", cmsg->CIPValue);
|
||||
|
|
Loading…
Reference in New Issue
Block a user