Staging: ced1401: fix a couple off by one checks
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 20 Sep 2012 08:43:54 +0000 (11:43 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 21 Sep 2012 15:56:41 +0000 (08:56 -0700)
nArea is used as an offset into the ->rTransDef[] array which has
MAX_TRANSAREAS elements.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/ced1401/ced_ioc.c

index 693c4544c29d410d0e4c68feb749e93e33e693d4..c9492edaaddb97ffb06ba796e0079f265549d6d7 100644 (file)
@@ -837,7 +837,7 @@ int SetEvent(DEVICE_EXTENSION * pdx, TRANSFEREVENT __user * pTE)
 int WaitEvent(DEVICE_EXTENSION * pdx, int nArea, int msTimeOut)
 {
        int iReturn;
-       if ((unsigned)nArea > MAX_TRANSAREAS)
+       if ((unsigned)nArea >= MAX_TRANSAREAS)
                return U14ERR_BADAREA;
        else {
                int iWait;
@@ -884,7 +884,7 @@ int WaitEvent(DEVICE_EXTENSION * pdx, int nArea, int msTimeOut)
 int TestEvent(DEVICE_EXTENSION * pdx, int nArea)
 {
        int iReturn;
-       if ((unsigned)nArea > MAX_TRANSAREAS)
+       if ((unsigned)nArea >= MAX_TRANSAREAS)
                iReturn = U14ERR_BADAREA;
        else {
                TRANSAREA *pTA = &pdx->rTransDef[nArea];