uwb: handle radio controller events with out-of-range IDs correctly
If a radio controller event has an ID that's just out of range don't read beyond the end of uwbd's event arrays. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David Vrabel <david.vrabel@csr.com>
This commit is contained in:
Родитель
7c0a57d5c4
Коммит
3fafdd7cc8
|
@ -187,12 +187,12 @@ int uwbd_event_handle_urc(struct uwb_event *evt)
|
|||
event = le16_to_cpu(evt->notif.rceb->wEvent);
|
||||
context = evt->notif.rceb->bEventContext;
|
||||
|
||||
if (type > ARRAY_SIZE(uwbd_urc_evt_type_handlers))
|
||||
if (type >= ARRAY_SIZE(uwbd_urc_evt_type_handlers))
|
||||
goto out;
|
||||
type_table = &uwbd_urc_evt_type_handlers[type];
|
||||
if (type_table->uwbd_events == NULL)
|
||||
goto out;
|
||||
if (event > type_table->size)
|
||||
if (event >= type_table->size)
|
||||
goto out;
|
||||
handler = type_table->uwbd_events[event].handler;
|
||||
if (handler == NULL)
|
||||
|
|
Загрузка…
Ссылка в новой задаче