diff options
| author | Holger Hans Peter Freyther <zecke@selfish.org> | 2009-12-21 17:06:07 +0100 |
|---|---|---|
| committer | Holger Hans Peter Freyther <zecke@selfish.org> | 2009-12-21 17:06:07 +0100 |
| commit | 306b7219ac616980b99a78f45b181aa980672d86 (patch) | |
| tree | 886051837a1417d879b83f5ecbdac95b9e729938 | |
| parent | 17c24c905785f967161dacde8b849c5b1ad275c4 (diff) | |
[abis] Do not access an array with N elements at index N
Possible crash fixes by preventing accessing the
array out of bounds.
| -rw-r--r-- | openbsc/src/abis_nm.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/openbsc/src/abis_nm.c b/openbsc/src/abis_nm.c index fc00ca8d6..bb7248be7 100644 --- a/openbsc/src/abis_nm.c +++ b/openbsc/src/abis_nm.c @@ -671,7 +671,7 @@ objclass2nmstate(struct gsm_bts *bts, u_int8_t obj_class, nm_state = &bts->bs11.rack.nm_state; break; case NM_OC_BS11_ENVABTSE: - if (obj_inst->trx_nr > ARRAY_SIZE(bts->bs11.envabtse)) + if (obj_inst->trx_nr >= ARRAY_SIZE(bts->bs11.envabtse)) return NULL; nm_state = &bts->bs11.envabtse[obj_inst->trx_nr].nm_state; break; @@ -682,7 +682,7 @@ objclass2nmstate(struct gsm_bts *bts, u_int8_t obj_class, nm_state = &bts->gprs.cell.nm_state; break; case NM_OC_GPRS_NSVC: - if (obj_inst->trx_nr > ARRAY_SIZE(bts->gprs.nsvc)) + if (obj_inst->trx_nr >= ARRAY_SIZE(bts->gprs.nsvc)) return NULL; nm_state = &bts->gprs.nsvc[obj_inst->trx_nr].nm_state; break; @@ -738,7 +738,7 @@ objclass2obj(struct gsm_bts *bts, u_int8_t obj_class, obj = &bts->gprs.cell; break; case NM_OC_GPRS_NSVC: - if (obj_inst->trx_nr > ARRAY_SIZE(bts->gprs.nsvc)) + if (obj_inst->trx_nr >= ARRAY_SIZE(bts->gprs.nsvc)) return NULL; obj = &bts->gprs.nsvc[obj_inst->trx_nr]; break; |