diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-08-29 10:47:00 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2013-08-30 23:52:44 +0200 |
| commit | 0d63c27d9e879a0b54eb405636d60ab12040ca46 (patch) | |
| tree | dd6f8abace89f2bd7b4c0bf988439eccc3956691 /drivers | |
| parent | net: revert 8728c544a9c ("net: dev_pick_tx() fix") (diff) | |
| download | linux-0d63c27d9e879a0b54eb405636d60ab12040ca46.tar.xz linux-0d63c27d9e879a0b54eb405636d60ab12040ca46.zip | |
mISDN: return -EINVAL on error in dsp_control_req()
If skb->len is too short then we should return an error. Otherwise we
read beyond the end of skb->data for several bytes.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/isdn/mISDN/dsp_core.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/isdn/mISDN/dsp_core.c b/drivers/isdn/mISDN/dsp_core.c index 22b720ec80cb..77025f5cb57d 100644 --- a/drivers/isdn/mISDN/dsp_core.c +++ b/drivers/isdn/mISDN/dsp_core.c @@ -288,8 +288,10 @@ dsp_control_req(struct dsp *dsp, struct mISDNhead *hh, struct sk_buff *skb) u8 *data; int len; - if (skb->len < sizeof(int)) + if (skb->len < sizeof(int)) { printk(KERN_ERR "%s: PH_CONTROL message too short\n", __func__); + return -EINVAL; + } cont = *((int *)skb->data); len = skb->len - sizeof(int); data = skb->data + sizeof(int); |