diff options
| author | Dan Carpenter | 2013-08-29 11:47:00 +0300 |
|---|---|---|
| committer | David S. Miller | 2013-08-30 17:52:44 -0400 |
| commit | 0d63c27d9e879a0b54eb405636d60ab12040ca46 (patch) | |
| tree | dd6f8abace89f2bd7b4c0bf988439eccc3956691 | |
| parent | 702821f4ea6f68db18aa1de7d8ed62c6ba586a64 (diff) | |
mISDN: return -EINVAL on error in dsp_control_req()
If skb->len is too short then we should return an error. Otherwise we
read beyond the end of skb->data for several bytes.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/isdn/mISDN/dsp_core.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/isdn/mISDN/dsp_core.c b/drivers/isdn/mISDN/dsp_core.c index 22b720ec80cb..77025f5cb57d 100644 --- a/drivers/isdn/mISDN/dsp_core.c +++ b/drivers/isdn/mISDN/dsp_core.c @@ -288,8 +288,10 @@ dsp_control_req(struct dsp *dsp, struct mISDNhead *hh, struct sk_buff *skb) u8 *data; int len; - if (skb->len < sizeof(int)) + if (skb->len < sizeof(int)) { printk(KERN_ERR "%s: PH_CONTROL message too short\n", __func__); + return -EINVAL; + } cont = *((int *)skb->data); len = skb->len - sizeof(int); data = skb->data + sizeof(int); |