summaryrefslogtreecommitdiff
path: root/sys/dev/bluetooth
diff options
context:
space:
mode:
authorchristos <christos@NetBSD.org>2015-04-16 19:53:19 +0000
committerchristos <christos@NetBSD.org>2015-04-16 19:53:19 +0000
commit72e6b7112d0125abf6359a895643dbddc253d210 (patch)
treec3942c4bfda20b9fce157d81ac05e079faba26e2 /sys/dev/bluetooth
parent8cf2c40b9d9add0142e1585eb02ce2bebd7ffc77 (diff)
CID 1293640/1 memory corruption/overrun
Diffstat (limited to 'sys/dev/bluetooth')
-rw-r--r--sys/dev/bluetooth/btmagic.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/sys/dev/bluetooth/btmagic.c b/sys/dev/bluetooth/btmagic.c
index 74a69a9c3c1..3d8b1e1a78f 100644
--- a/sys/dev/bluetooth/btmagic.c
+++ b/sys/dev/bluetooth/btmagic.c
@@ -1,4 +1,4 @@
-/* $NetBSD: btmagic.c,v 1.12 2015/04/06 17:45:31 bouyer Exp $ */
+/* $NetBSD: btmagic.c,v 1.13 2015/04/16 19:53:19 christos Exp $ */
/*-
* Copyright (c) 2010 The NetBSD Foundation, Inc.
@@ -85,7 +85,7 @@
*****************************************************************************/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: btmagic.c,v 1.12 2015/04/06 17:45:31 bouyer Exp $");
+__KERNEL_RCSID(0, "$NetBSD: btmagic.c,v 1.13 2015/04/16 19:53:19 christos Exp $");
#include <sys/param.h>
#include <sys/conf.h>
@@ -1523,6 +1523,8 @@ btmagic_input_magict(struct btmagic_softc *sc, uint8_t *data, size_t len)
*/
continue;
}
+ if (id >= __arraycount(sc->sc_ax))
+ continue;
tx = ax - sc->sc_ax[id];
ty = ay - sc->sc_ay[id];
@@ -1562,6 +1564,9 @@ btmagic_input_magict(struct btmagic_softc *sc, uint8_t *data, size_t len)
break;
}
+ if (id >= __arraycount(sc->sc_ax))
+ continue;
+
sc->sc_ax[id] = ax;
sc->sc_ay[id] = ay;
}