diff options
| author | Jonathan Gray <jsg@cvs.openbsd.org> | 2017-08-21 14:38:33 +0000 |
|---|---|---|
| committer | Jonathan Gray <jsg@cvs.openbsd.org> | 2017-08-21 14:38:33 +0000 |
| commit | 374ff1000419ceaf5fdef131f0bd04a0e0377a04 (patch) | |
| tree | aca4062a88f57bef6c1580d73673e01760c37df9 /sys/dev/usb | |
| parent | f7144a749e9b3835c24e442c026356e9b37ab8cb (diff) | |
Fix off by one in array bounds tests when parsing descriptors.
Coverity CIDs 1452970 1453305.
Diffstat (limited to 'sys/dev/usb')
| -rw-r--r-- | sys/dev/usb/uvideo.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/dev/usb/uvideo.c b/sys/dev/usb/uvideo.c index 8036cf8d259..8abf1b47a56 100644 --- a/sys/dev/usb/uvideo.c +++ b/sys/dev/usb/uvideo.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uvideo.c,v 1.194 2017/04/08 02:57:25 deraadt Exp $ */ +/* $OpenBSD: uvideo.c,v 1.195 2017/08/21 14:38:32 jsg Exp $ */ /* * Copyright (c) 2008 Robert Nagy <robert@openbsd.org> @@ -957,7 +957,7 @@ uvideo_vs_parse_desc_format_mjpeg(struct uvideo_softc *sc, return (USBD_INVAL); } - if (sc->sc_fmtgrp_idx > UVIDEO_MAX_FORMAT) { + if (sc->sc_fmtgrp_idx >= UVIDEO_MAX_FORMAT) { printf("%s: too many format descriptors found!\n", DEVNAME(sc)); return (USBD_INVAL); } @@ -999,7 +999,7 @@ uvideo_vs_parse_desc_format_uncompressed(struct uvideo_softc *sc, return (USBD_INVAL); } - if (sc->sc_fmtgrp_idx > UVIDEO_MAX_FORMAT) { + if (sc->sc_fmtgrp_idx >= UVIDEO_MAX_FORMAT) { printf("%s: too many format descriptors found!\n", DEVNAME(sc)); return (USBD_INVAL); } |