diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-10-06 02:32:53 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-10-07 09:07:18 +0200 |
| commit | 5287bf726ff8a7353e883b73576710fd53dc88bb (patch) | |
| tree | 2eb133d1896892d95439812c74f8d0181d7c6def /drivers | |
| parent | USB/host: Bugfix: Return length of copied buffer in uhci_hub_control() (diff) | |
| download | linux-5287bf726ff8a7353e883b73576710fd53dc88bb.tar.xz linux-5287bf726ff8a7353e883b73576710fd53dc88bb.zip | |
USB: cyberjack: fix buggy integer overflow test
"old_rdtodo" and "size" are short type. They are type promoted to int
and the condition is never true.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/usb/serial/cyberjack.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c index 781426230d69..6e1b69d0f5f5 100644 --- a/drivers/usb/serial/cyberjack.c +++ b/drivers/usb/serial/cyberjack.c @@ -279,7 +279,7 @@ static void cyberjack_read_int_callback(struct urb *urb) old_rdtodo = priv->rdtodo; - if (old_rdtodo + size < old_rdtodo) { + if (old_rdtodo > SHRT_MAX - size) { dev_dbg(dev, "To many bulk_in urbs to do.\n"); spin_unlock(&priv->lock); goto resubmit; |