nfc: nci: Potential off by one in ->pipes[] array

This is similar to commit e285d5bfb7e9 ("NFC: Fix the number of pipes") where we changed NFC_HCI_MAX_PIPES from 127 to 128. As the comment next to the define explains, the pipe identifier is 7 bits long. The highest possible pipe is 127, but the number of possible pipes is 128. As the code is now, then there is potential for an out of bounds array access: net/nfc/nci/hci.c:297 nci_hci_cmd_received() warn: array off by one? 'ndev->hci_dev->pipes[pipe]' '0-127 == 127'

Dan Carpenter committed 7 years ago

Commit 6491d691 parent d7ee81a1 file · +1 −1Browse files

Showing the changes to include (1 of 1 file). Show all

Unified · Split

include/net/nfc/nci_core.h+1−1

@@ -166,7 +166,7 @@ struct nci_conn_info { · 165 unmodified lines
166	* According to specification 102 622 chapter 4.4 Pipes,	166	* According to specification 102 622 chapter 4.4 Pipes,
167	* the pipe identifier is 7 bits long.	167	* the pipe identifier is 7 bits long.
168	*/	168	*/
169	#define NCI_HCI_MAX_PIPES 127	169	#define NCI_HCI_MAX_PIPES 128
170		170
171	struct nci_hci_gate {	171	struct nci_hci_gate {
172	u8 gate;	172	u8 gate;