summaryrefslogtreecommitdiffstats
path: root/drivers/media/usb/gspca
diff options
context:
space:
mode:
authorHans de Goede <hdegoede@redhat.com>2014-02-23 23:01:58 +0100
committerMauro Carvalho Chehab <m.chehab@samsung.com>2014-02-28 18:38:16 +0100
commite15fd24495dedb50068e649173ba65a70af63d16 (patch)
treee5683951e3f7c59af9481b8a1741be1abbbc9e59 /drivers/media/usb/gspca
parent[media] gspca_stv06xx: remove an unneeded check (diff)
downloadlinux-e15fd24495dedb50068e649173ba65a70af63d16.tar.xz
linux-e15fd24495dedb50068e649173ba65a70af63d16.zip
[media] gspca_topro: Add a couple of missing length check in the packet parsing code
Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Diffstat (limited to 'drivers/media/usb/gspca')
-rw-r--r--drivers/media/usb/gspca/topro.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/media/usb/gspca/topro.c b/drivers/media/usb/gspca/topro.c
index 640c2fe760b3..5fcd1eec2004 100644
--- a/drivers/media/usb/gspca/topro.c
+++ b/drivers/media/usb/gspca/topro.c
@@ -4631,8 +4631,16 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
}
data++;
len--;
+ if (len < 2) {
+ gspca_dev->last_packet_type = DISCARD_PACKET;
+ return;
+ }
if (*data == 0xff && data[1] == 0xd8) {
/*fixme: there may be information in the 4 high bits*/
+ if (len < 7) {
+ gspca_dev->last_packet_type = DISCARD_PACKET;
+ return;
+ }
if ((data[6] & 0x0f) != sd->quality)
set_dqt(gspca_dev, data[6] & 0x0f);
gspca_frame_add(gspca_dev, FIRST_PACKET,
@@ -4672,7 +4680,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
gspca_dev->last_packet_type = DISCARD_PACKET;
break;
case 0xcc:
- if (data[1] != 0xff || data[2] != 0xd8)
+ if (len >= 3 && (data[1] != 0xff || data[2] != 0xd8))
gspca_frame_add(gspca_dev, INTER_PACKET,
data + 1, len - 1);
else