diff options
| author | Harald Welte <laforge@gnumonks.org> | 2010-03-07 01:07:48 +0100 |
|---|---|---|
| committer | Harald Welte <laforge@gnumonks.org> | 2010-03-07 01:07:48 +0100 |
| commit | 0de8d3fca6aff4b79e541c957198b8c45a6d512b (patch) | |
| tree | 8fae4beb223fd8c2e58fb97540c1969795fad991 | |
| parent | 177ce424a69512c13f7646c64acaac0955c98d76 (diff) | |
sercomm: prevent DLCI array overflow
| -rw-r--r-- | src/target/firmware/comm/sercomm.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/src/target/firmware/comm/sercomm.c b/src/target/firmware/comm/sercomm.c index 7baedcd3..ddc53df3 100644 --- a/src/target/firmware/comm/sercomm.c +++ b/src/target/firmware/comm/sercomm.c @@ -190,10 +190,12 @@ int sercomm_register_rx_cb(uint8_t dlci, dlci_cb_t cb) /* dispatch an incomnig message once it is completely received */ static void dispatch_rx_msg(uint8_t dlci, struct msgb *msg) { - if (sercomm.rx.dlci_handler[dlci]) - sercomm.rx.dlci_handler[dlci](dlci, msg); - else + if (dlci >= ARRAY_SIZE(sercomm.rx.dlci_handler) || + !sercomm.rx.dlci_handler[dlci]) { msgb_free(msg); + return; + } + sercomm.rx.dlci_handler[dlci](dlci, msg); } /* the driver has received one byte, pass it into sercomm layer */ |