diff options
| author | christos <christos@NetBSD.org> | 2015-04-16 19:53:19 +0000 |
|---|---|---|
| committer | christos <christos@NetBSD.org> | 2015-04-16 19:53:19 +0000 |
| commit | 72e6b7112d0125abf6359a895643dbddc253d210 (patch) | |
| tree | c3942c4bfda20b9fce157d81ac05e079faba26e2 /sys/dev/bluetooth | |
| parent | 8cf2c40b9d9add0142e1585eb02ce2bebd7ffc77 (diff) | |
CID 1293640/1 memory corruption/overrun
Diffstat (limited to 'sys/dev/bluetooth')
| -rw-r--r-- | sys/dev/bluetooth/btmagic.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/sys/dev/bluetooth/btmagic.c b/sys/dev/bluetooth/btmagic.c index 74a69a9c3c1..3d8b1e1a78f 100644 --- a/sys/dev/bluetooth/btmagic.c +++ b/sys/dev/bluetooth/btmagic.c @@ -1,4 +1,4 @@ -/* $NetBSD: btmagic.c,v 1.12 2015/04/06 17:45:31 bouyer Exp $ */ +/* $NetBSD: btmagic.c,v 1.13 2015/04/16 19:53:19 christos Exp $ */ /*- * Copyright (c) 2010 The NetBSD Foundation, Inc. @@ -85,7 +85,7 @@ *****************************************************************************/ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: btmagic.c,v 1.12 2015/04/06 17:45:31 bouyer Exp $"); +__KERNEL_RCSID(0, "$NetBSD: btmagic.c,v 1.13 2015/04/16 19:53:19 christos Exp $"); #include <sys/param.h> #include <sys/conf.h> @@ -1523,6 +1523,8 @@ btmagic_input_magict(struct btmagic_softc *sc, uint8_t *data, size_t len) */ continue; } + if (id >= __arraycount(sc->sc_ax)) + continue; tx = ax - sc->sc_ax[id]; ty = ay - sc->sc_ay[id]; @@ -1562,6 +1564,9 @@ btmagic_input_magict(struct btmagic_softc *sc, uint8_t *data, size_t len) break; } + if (id >= __arraycount(sc->sc_ax)) + continue; + sc->sc_ax[id] = ax; sc->sc_ay[id] = ay; } |
