diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2015-06-02 12:20:25 (GMT) |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2015-06-08 20:38:56 (GMT) |
| commit | ba470f7c0e9f4a71a915a48392e69f56ce7edbf9 (patch) | |
| tree | 7334b74d05c627384703b2eb03e9301d6ec5adf2 | |
| parent | c938699ebb92918afe66776bb6d69277aea86507 (diff) | |
| download | linux-ba470f7c0e9f4a71a915a48392e69f56ce7edbf9.tar.xz | |
staging: ozwpan: prevent a couple of underflows
The underflow in OZ_DATA_F_ISOC_FIXED seems not harmful, but this patch
is a clean up and makes my static checker a bit happier.
The underflow in OZ_VENDOR_CLASS_RSP seems like it could result in
memory corruption.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/ozwpan/ozusbsvc1.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c index f660bb1..301fee8 100644 --- a/drivers/staging/ozwpan/ozusbsvc1.c +++ b/drivers/staging/ozwpan/ozusbsvc1.c @@ -342,12 +342,16 @@ static void oz_usb_handle_ep_data(struct oz_usb_ctx *usb_ctx, case OZ_DATA_F_ISOC_FIXED: { struct oz_isoc_fixed *body = (struct oz_isoc_fixed *)data_hdr; - int data_len = len-sizeof(struct oz_isoc_fixed)+1; + int data_len; int unit_size = body->unit_size; u8 *data = body->data; int count; int i; + if (len < sizeof(struct oz_isoc_fixed) - 1) + break; + data_len = len - (sizeof(struct oz_isoc_fixed) - 1); + if (!unit_size) break; count = data_len/unit_size; @@ -427,6 +431,11 @@ void oz_usb_rx(struct oz_pd *pd, struct oz_elt *elt) case OZ_VENDOR_CLASS_RSP: { struct oz_vendor_class_rsp *body = (struct oz_vendor_class_rsp *)usb_hdr; + + if (elt->length < + sizeof(struct oz_vendor_class_rsp) - 1) + break; + oz_hcd_control_cnf(usb_ctx->hport, body->req_id, body->rcode, body->data, elt->length- sizeof(struct oz_vendor_class_rsp)+1); |