diff options
| author | Wim Van Sebroeck <wim@iguana.be> | 2007-05-01 08:53:01 +0200 |
|---|---|---|
| committer | Wim Van Sebroeck <wim@iguana.be> | 2007-05-01 08:53:01 +0200 |
| commit | 48a7afe314bfc4d7f50e1608632f503dbba7e013 (patch) | |
| tree | 4a80e6b96321a71affd1bacea817de93be08894b /drivers/ieee1394/raw1394.c | |
| parent | [WATCHDOG] Semi-typical watchdog bug re early misc_register() (diff) | |
| parent | libata: honour host controllers that want just one host (diff) | |
| download | linux-48a7afe314bfc4d7f50e1608632f503dbba7e013.tar.xz linux-48a7afe314bfc4d7f50e1608632f503dbba7e013.zip | |
Merge /pub/scm/linux/kernel/git/torvalds/linux-2.6
Diffstat (limited to 'drivers/ieee1394/raw1394.c')
| -rw-r--r-- | drivers/ieee1394/raw1394.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/ieee1394/raw1394.c b/drivers/ieee1394/raw1394.c index bb897a37d9f7..c6aefd9ad0e8 100644 --- a/drivers/ieee1394/raw1394.c +++ b/drivers/ieee1394/raw1394.c @@ -938,7 +938,8 @@ static int handle_async_send(struct file_info *fi, struct pending_request *req) int header_length = req->req.misc & 0xffff; int expect_response = req->req.misc >> 16; - if ((header_length > req->req.length) || (header_length < 12)) { + if (header_length > req->req.length || header_length < 12 || + header_length > FIELD_SIZEOF(struct hpsb_packet, header)) { req->req.error = RAW1394_ERROR_INVALID_ARG; req->req.length = 0; queue_complete_req(req); |