Commit 498b9cb8 authored by Randy Dunlap's avatar Randy Dunlap Committed by Kai Germaschewski

[PATCH] checker bounds/limits fixes

Part of the bounds checking bugs found by the Stanford checker.

The 4 fixes below have been acked by their maintainers.
parent e3b4a0e0
...@@ -763,7 +763,7 @@ uint UnitId; ...@@ -763,7 +763,7 @@ uint UnitId;
#endif #endif
UnitId--; /* this trick relies on the Unit Id being UNSIGNED! */ UnitId--; /* this trick relies on the Unit Id being UNSIGNED! */
if ( UnitId > MAX_RUP ) /* dontcha just lurv unsigned maths! */ if ( UnitId >= MAX_RUP ) /* dontcha just lurv unsigned maths! */
return(0); return(0);
if ( HostP->Mapping[UnitId].Flags & BEEN_HERE ) if ( HostP->Mapping[UnitId].Flags & BEEN_HERE )
......
...@@ -1456,7 +1456,7 @@ static int sx_open(struct tty_struct * tty, struct file * filp) ...@@ -1456,7 +1456,7 @@ static int sx_open(struct tty_struct * tty, struct file * filp)
board = SX_BOARD(minor(tty->device)); board = SX_BOARD(minor(tty->device));
if (board > SX_NBOARD || !(sx_board[board].flags & SX_BOARD_PRESENT)) if (board >= SX_NBOARD || !(sx_board[board].flags & SX_BOARD_PRESENT))
return -ENODEV; return -ENODEV;
bp = &sx_board[board]; bp = &sx_board[board];
...@@ -2363,7 +2363,7 @@ int specialix_init(void) ...@@ -2363,7 +2363,7 @@ int specialix_init(void)
struct pci_dev *pdev = NULL; struct pci_dev *pdev = NULL;
i=0; i=0;
while (i <= SX_NBOARD) { while (i < SX_NBOARD) {
if (sx_board[i].flags & SX_BOARD_PRESENT) { if (sx_board[i].flags & SX_BOARD_PRESENT) {
i++; i++;
continue; continue;
......
...@@ -92,7 +92,7 @@ int bt_sock_unregister(int proto) ...@@ -92,7 +92,7 @@ int bt_sock_unregister(int proto)
static int bt_sock_create(struct socket *sock, int proto) static int bt_sock_create(struct socket *sock, int proto)
{ {
if (proto > BT_MAX_PROTO) if (proto >= BT_MAX_PROTO)
return -EINVAL; return -EINVAL;
#if defined(CONFIG_KMOD) #if defined(CONFIG_KMOD)
......
...@@ -351,7 +351,7 @@ rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, int *errp) ...@@ -351,7 +351,7 @@ rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, int *errp)
return 0; return 0;
family = ((struct rtgenmsg*)NLMSG_DATA(nlh))->rtgen_family; family = ((struct rtgenmsg*)NLMSG_DATA(nlh))->rtgen_family;
if (family > NPROTO) { if (family >= NPROTO) {
*errp = -EAFNOSUPPORT; *errp = -EAFNOSUPPORT;
return -1; return -1;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment