Add additional sanity checks to osl_get_rank().

Check whether the riven rank is greater than zero and not greater than
the number of rows in the table.

diff --git a/osl.c b/osl.c
index 5c80641930af2125cdaf7b7ad17e880abbc16c93..9843a02034fc8927bdcce36be4bc6f7959d6f88d 100644 (file)
--- a/osl.c
+++ b/osl.c
@@ -2013,8 +2013,17 @@ int osl_get_nth_row(const struct osl_table *t, unsigned col_num,
 {
        struct osl_column *col;
        struct rb_node *node;
-       int ret = check_rbtree_col(t, col_num, &col);
+       unsigned num_rows;
+       int ret;
 
+       if (n == 0)
+               return -E_RB_KEY_NOT_FOUND;
+       ret = osl_get_num_rows(t, &num_rows);
+       if (ret < 0)
+               return ret;
+       if (n > num_rows)
+               return -E_RB_KEY_NOT_FOUND;
+       ret = check_rbtree_col(t, col_num, &col);
        if (ret < 0)
                return ret;
        node = rb_nth(col->rbtree.rb_node, n);