Staging: ced1401: fix a couple off by one checks

nArea is used as an offset into the ->rTransDef[] array which has
MAX_TRANSAREAS elements.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/ced1401/ced_ioc.c b/drivers/staging/ced1401/ced_ioc.c
index 693c4544c29d410d0e4c68feb749e93e33e693d4..c9492edaaddb97ffb06ba796e0079f265549d6d7 100644 (file)
--- a/drivers/staging/ced1401/ced_ioc.c
+++ b/drivers/staging/ced1401/ced_ioc.c
@@ -837,7 +837,7 @@ int SetEvent(DEVICE_EXTENSION * pdx, TRANSFEREVENT __user * pTE)
 int WaitEvent(DEVICE_EXTENSION * pdx, int nArea, int msTimeOut)
 {
        int iReturn;
-       if ((unsigned)nArea > MAX_TRANSAREAS)
+       if ((unsigned)nArea >= MAX_TRANSAREAS)
                return U14ERR_BADAREA;
        else {
                int iWait;
@@ -884,7 +884,7 @@ int WaitEvent(DEVICE_EXTENSION * pdx, int nArea, int msTimeOut)
 int TestEvent(DEVICE_EXTENSION * pdx, int nArea)
 {
        int iReturn;
-       if ((unsigned)nArea > MAX_TRANSAREAS)
+       if ((unsigned)nArea >= MAX_TRANSAREAS)
                iReturn = U14ERR_BADAREA;
        else {
                TRANSAREA *pTA = &pdx->rTransDef[nArea];