diff options
| author | Pandiyarajan Pitchaimuthu <c_ppitch@qca.qualcomm.com> | 2012-09-21 20:11:46 +0530 |
|---|---|---|
| committer | Kalle Valo <kvalo@qca.qualcomm.com> | 2012-10-24 11:49:55 +0300 |
| commit | 86aa7c1efc63e0969dee575ac9e021dbcbaa95c3 (patch) | |
| tree | bcf73adfa16c0ab75ec3b62d9a61ef17baaef469 /drivers/net/wireless/ath/ath6kl/htc_mbox.c | |
| parent | 698bf867d0d3b5669c4e85b29d2a44043a2c5c99 (diff) | |
| download | linux-86aa7c1efc63e0969dee575ac9e021dbcbaa95c3.tar.bz2 | |
ath6kl: Array index out of bounds check
The variable assigned_ep can be assigned value of -1 and is never
checked if it equals -1. So the endpoint array can have -1 as the index
value and can be out of bounds.
The value of assigned_ep is checked for -1 and is ensured that the
endpoint array doesn't go out of bounds.
Signed-off-by: Pandiyarajan Pitchaimuthu <c_ppitch@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Diffstat (limited to 'drivers/net/wireless/ath/ath6kl/htc_mbox.c')
| -rw-r--r-- | drivers/net/wireless/ath/ath6kl/htc_mbox.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/ath/ath6kl/htc_mbox.c b/drivers/net/wireless/ath/ath6kl/htc_mbox.c index cd0e1ba410d6..ceaf92192658 100644 --- a/drivers/net/wireless/ath/ath6kl/htc_mbox.c +++ b/drivers/net/wireless/ath/ath6kl/htc_mbox.c @@ -2492,7 +2492,8 @@ static int ath6kl_htc_mbox_conn_service(struct htc_target *target, max_msg_sz = le16_to_cpu(resp_msg->max_msg_sz); } - if (assigned_ep >= ENDPOINT_MAX || !max_msg_sz) { + if (WARN_ON_ONCE(assigned_ep == ENDPOINT_UNUSED || + assigned_ep >= ENDPOINT_MAX || !max_msg_sz)) { status = -ENOMEM; goto fail_tx; } |