diff options
author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-04-05 05:43:20 (GMT) |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-04-05 21:11:25 (GMT) |
commit | 01a60e76b6392547ad3dca3ac05b9c886fa5da45 (patch) | |
tree | 5fe22932e6ad9f325e43a374d3cd5376117fd047 | |
parent | 6a3ae8412f9e9cee0e8647954f4f7f2c50664ca2 (diff) | |
download | linux-01a60e76b6392547ad3dca3ac05b9c886fa5da45.tar.xz |
USB: keyspan: add a sanity test on "len"
"len" comes from the USB transfer and it's probably correct. The thing
is that we already have similar checks like:
if (data[i] >= serial->num_ports) {
So adding a sanity test here matches the rest of the code and is a good
idea.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r-- | drivers/usb/serial/keyspan.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c index 3d92394..025310b 100644 --- a/drivers/usb/serial/keyspan.c +++ b/drivers/usb/serial/keyspan.c @@ -741,14 +741,15 @@ static void usa49wg_indat_callback(struct urb *urb) if ((data[i] & 0x80) == 0) { /* no error on any byte */ i++; - for (x = 1; x < len ; ++x) + for (x = 1; x < len && i < urb->actual_length; ++x) tty_insert_flip_char(&port->port, data[i++], 0); } else { /* * some bytes had errors, every byte has status */ - for (x = 0; x + 1 < len; x += 2) { + for (x = 0; x + 1 < len && + i + 1 < urb->actual_length; x += 2) { int stat = data[i], flag = 0; if (stat & RXERROR_OVERRUN) |