Commit 3fafdd7c authored by David Vrabel's avatar David Vrabel

uwb: handle radio controller events with out-of-range IDs correctly

If a radio controller event has an ID that's just out of range don't
read beyond the end of uwbd's event arrays.
Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarDavid Vrabel <david.vrabel@csr.com>
parent 7c0a57d5
...@@ -187,12 +187,12 @@ int uwbd_event_handle_urc(struct uwb_event *evt) ...@@ -187,12 +187,12 @@ int uwbd_event_handle_urc(struct uwb_event *evt)
event = le16_to_cpu(evt->notif.rceb->wEvent); event = le16_to_cpu(evt->notif.rceb->wEvent);
context = evt->notif.rceb->bEventContext; context = evt->notif.rceb->bEventContext;
if (type > ARRAY_SIZE(uwbd_urc_evt_type_handlers)) if (type >= ARRAY_SIZE(uwbd_urc_evt_type_handlers))
goto out; goto out;
type_table = &uwbd_urc_evt_type_handlers[type]; type_table = &uwbd_urc_evt_type_handlers[type];
if (type_table->uwbd_events == NULL) if (type_table->uwbd_events == NULL)
goto out; goto out;
if (event > type_table->size) if (event >= type_table->size)
goto out; goto out;
handler = type_table->uwbd_events[event].handler; handler = type_table->uwbd_events[event].handler;
if (handler == NULL) if (handler == NULL)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment