diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2015-03-10 10:39:42 +0300 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2015-03-12 11:08:58 +0100 |
| commit | cb1185a4ae29367d00b0ae19413d64303c8c0e51 (patch) | |
| tree | 16a0efdcee5edef451c4989313f3f4551a9fb211 /drivers/staging/dgnc | |
| parent | dgnc: Make all lines under 80 characters in dgnc_driver.c (diff) | |
| download | linux-dev-cb1185a4ae29367d00b0ae19413d64303c8c0e51.tar.xz linux-dev-cb1185a4ae29367d00b0ae19413d64303c8c0e51.zip | |
staging: dgnc: off by one in dgnc_mgmt_ioctl()
"dgnc_NumBoards" is the number of initialized elements in the
dgnc_Board[] array so the comparison should be ">=" instead of ">" so we
don't read invalid data. We can remove the special handling of the
empty array now that we've fixed this bug.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/dgnc')
| -rw-r--r-- | drivers/staging/dgnc/dgnc_mgmt.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/staging/dgnc/dgnc_mgmt.c b/drivers/staging/dgnc/dgnc_mgmt.c index 5544a8e7f4bc..b89bd59d8da8 100644 --- a/drivers/staging/dgnc/dgnc_mgmt.c +++ b/drivers/staging/dgnc/dgnc_mgmt.c @@ -153,8 +153,7 @@ long dgnc_mgmt_ioctl(struct file *file, unsigned int cmd, unsigned long arg) if (copy_from_user(&brd, uarg, sizeof(int))) return -EFAULT; - if ((brd < 0) || (brd > dgnc_NumBoards) || - (dgnc_NumBoards == 0)) + if (brd < 0 || brd >= dgnc_NumBoards) return -ENODEV; memset(&di, 0, sizeof(di)); |