Re: [PATCH 2/2 net] nfc: nci: Potential off by one in ->pipes[] array

David Miller
2019-04-06T22:04:48Z

From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 3 Apr 2019 10:13:51 +0300

> This is similar to commit e285d5bfb7e9 ("NFC: Fix the number of pipes")
> where we changed NFC_HCI_MAX_PIPES from 127 to 128.
>
> As the comment next to the define explains, the pipe identifier is 7
> bits long. The highest possible pipe is 127, but the number of possible
> pipes is 128. As the code is now, then there is potential for an
> out of bounds array access:
>
> net/nfc/nci/hci.c:297 nci_hci_cmd_received() warn: array off by one?
> 'ndev->hci_dev->pipes[pipe]' '0-127 = 127'
>
> Fixes: 11f54f228643 ("NFC: nci: Add HCI over NCI protocol support")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Applied.