diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-09-20 11:43:54 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-09-21 08:56:41 -0700 |
| commit | 428ed14f366276550a70014ed80be941d7e721d5 (patch) | |
| tree | bda1b63bebe072f9356f6945f861cce6de0cf746 /drivers/staging/ced1401 | |
| parent | bff6c3e00ca7e56ca82e19ffb722159cf1216d20 (diff) | |
Staging: ced1401: fix a couple off by one checks
nArea is used as an offset into the ->rTransDef[] array which has
MAX_TRANSAREAS elements.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/ced1401')
| -rw-r--r-- | drivers/staging/ced1401/ced_ioc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/staging/ced1401/ced_ioc.c b/drivers/staging/ced1401/ced_ioc.c index 693c4544c29d..c9492edaaddb 100644 --- a/drivers/staging/ced1401/ced_ioc.c +++ b/drivers/staging/ced1401/ced_ioc.c @@ -837,7 +837,7 @@ int SetEvent(DEVICE_EXTENSION * pdx, TRANSFEREVENT __user * pTE) int WaitEvent(DEVICE_EXTENSION * pdx, int nArea, int msTimeOut) { int iReturn; - if ((unsigned)nArea > MAX_TRANSAREAS) + if ((unsigned)nArea >= MAX_TRANSAREAS) return U14ERR_BADAREA; else { int iWait; @@ -884,7 +884,7 @@ int WaitEvent(DEVICE_EXTENSION * pdx, int nArea, int msTimeOut) int TestEvent(DEVICE_EXTENSION * pdx, int nArea) { int iReturn; - if ((unsigned)nArea > MAX_TRANSAREAS) + if ((unsigned)nArea >= MAX_TRANSAREAS) iReturn = U14ERR_BADAREA; else { TRANSAREA *pTA = &pdx->rTransDef[nArea]; |