[PATCH] rio: fix array checking
authorAlan Cox <alan@lxorguk.ukuu.org.uk>
Mon, 16 Oct 2006 15:28:44 +0000 (16:28 +0100)
committerLinus Torvalds <torvalds@g5.osdl.org>
Mon, 16 Oct 2006 15:27:54 +0000 (08:27 -0700)
Found by an analysis tool and reported to the list. Fix is simple enough

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
drivers/char/rio/rioctrl.c

index 052e8120a4713ccc2008e8f2f88988bc1adb0985..7ce77619707cf2f4fa1db2480d1acaebaf968ca9 100644 (file)
@@ -662,7 +662,7 @@ int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su
                        p->RIOError.Error = COPYIN_FAILED;
                        return -EFAULT;
                }
-               if (portStats.port >= RIO_PORTS) {
+               if (portStats.port < 0 || portStats.port >= RIO_PORTS) {
                        p->RIOError.Error = PORT_NUMBER_OUT_OF_RANGE;
                        return -ENXIO;
                }
@@ -702,7 +702,7 @@ int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su
                        p->RIOError.Error = COPYIN_FAILED;
                        return -EFAULT;
                }
-               if (portStats.port >= RIO_PORTS) {
+               if (portStats.port < 0 || portStats.port >= RIO_PORTS) {
                        p->RIOError.Error = PORT_NUMBER_OUT_OF_RANGE;
                        return -ENXIO;
                }