summaryrefslogtreecommitdiff
path: root/net/nfc
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2019-04-09 09:39:36 +0300
committerDavid S. Miller <davem@davemloft.net>2019-04-09 09:39:36 +0300
commit310655b07ae8ef0b8fdb641b610ded2052215664 (patch)
treed9b7a500ef21a087a337e1f1bb9218000cf1c03d /net/nfc
parent7f301cff1fc20c5b91203c5e610cf95782081d5d (diff)
parent869e3305f23dfeacdaa234717c92ccb237815d90 (diff)
downloadlinux-310655b07ae8ef0b8fdb641b610ded2052215664.tar.xz
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Diffstat (limited to 'net/nfc')
-rw-r--r--net/nfc/nci/hci.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c
index ddfc52ac1f9b..c0d323b58e73 100644
--- a/net/nfc/nci/hci.c
+++ b/net/nfc/nci/hci.c
@@ -312,6 +312,10 @@ static void nci_hci_cmd_received(struct nci_dev *ndev, u8 pipe,
create_info = (struct nci_hci_create_pipe_resp *)skb->data;
dest_gate = create_info->dest_gate;
new_pipe = create_info->pipe;
+ if (new_pipe >= NCI_HCI_MAX_PIPES) {
+ status = NCI_HCI_ANY_E_NOK;
+ goto exit;
+ }
/* Save the new created pipe and bind with local gate,
* the description for skb->data[3] is destination gate id
@@ -336,6 +340,10 @@ static void nci_hci_cmd_received(struct nci_dev *ndev, u8 pipe,
goto exit;
}
delete_info = (struct nci_hci_delete_pipe_noti *)skb->data;
+ if (delete_info->pipe >= NCI_HCI_MAX_PIPES) {
+ status = NCI_HCI_ANY_E_NOK;
+ goto exit;
+ }
ndev->hci_dev->pipes[delete_info->pipe].gate =
NCI_HCI_INVALID_GATE;