summaryrefslogtreecommitdiff
path: root/drivers/isdn/capi
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2013-05-19 12:36:36 +0400
committerDavid S. Miller <davem@davemloft.net>2013-05-21 00:38:14 +0400
commit25dff94ff9df40d4d663bb6ea3193a7758cc50e5 (patch)
tree2371e9c1dea647c690a2b01255d462656a8393ce /drivers/isdn/capi
parent057cf65e4f715f62acccbd9125cf63eddfe69d30 (diff)
downloadlinux-25dff94ff9df40d4d663bb6ea3193a7758cc50e5.tar.xz
isdn/kcapi: fix a small underflow
In get_capi_ctr_by_nr() and get_capi_appl_by_nr() the parameter comes from skb->data. The current code can underflow to one space before the start of the array. The sanity check isn't needed in __get_capi_appl_by_nr() but I changed it to match the others. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/isdn/capi')
-rw-r--r--drivers/isdn/capi/kcapi.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
index 9b1b274c7d25..c123709acf82 100644
--- a/drivers/isdn/capi/kcapi.c
+++ b/drivers/isdn/capi/kcapi.c
@@ -93,7 +93,7 @@ capi_ctr_put(struct capi_ctr *ctr)
static inline struct capi_ctr *get_capi_ctr_by_nr(u16 contr)
{
- if (contr - 1 >= CAPI_MAXCONTR)
+ if (contr < 1 || contr - 1 >= CAPI_MAXCONTR)
return NULL;
return capi_controller[contr - 1];
@@ -103,7 +103,7 @@ static inline struct capi20_appl *__get_capi_appl_by_nr(u16 applid)
{
lockdep_assert_held(&capi_controller_lock);
- if (applid - 1 >= CAPI_MAXAPPL)
+ if (applid < 1 || applid - 1 >= CAPI_MAXAPPL)
return NULL;
return capi_applications[applid - 1];
@@ -111,7 +111,7 @@ static inline struct capi20_appl *__get_capi_appl_by_nr(u16 applid)
static inline struct capi20_appl *get_capi_appl_by_nr(u16 applid)
{
- if (applid - 1 >= CAPI_MAXAPPL)
+ if (applid < 1 || applid - 1 >= CAPI_MAXAPPL)
return NULL;
return rcu_dereference(capi_applications[applid - 1]);