nfc: nci: Potential off by one in ->pipes[] array

This is similar to commit e285d5bfb7e9 ("NFC: Fix the number of pipes") where we changed NFC_HCI_MAX_PIPES from 127 to 128. As the comment next to the define explains, the pipe identifier is 7 bits long. The highest possible pipe is 127, but the number of possible pipes is 128. As the code is now, then there is potential for an out of bounds array access: net/nfc/nci/hci.c:297 nci_hci_cmd_received() warn: array off by one? 'ndev->hci_dev->pipes[pipe]' '0-127 == 127'

Dan Carpenter committed 7 years ago

Commit 6491d691 parent d7ee81a1 file · +1 −1Browse files

Showing the changes to include (1 of 1 file). Show all

Unified · Split

include/net/nfc/nci_core.h+1−1

@@ -166,7 +166,7 @@ struct nci_conn_info { · 165 unmodified lines
166	166	* According to specification 102 622 chapter 4.4 Pipes,
167	167	* the pipe identifier is 7 bits long.
168	168	*/
169		−#define NCI_HCI_MAX_PIPES 127
	169	+#define NCI_HCI_MAX_PIPES 128
170	170
171	171	struct nci_hci_gate {
172	172	u8 gate;