leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mISDN: return -EINVAL on error in dsp_control_req()

Browse Source 
If skb->len is too short then we should return an error.  Otherwise we
read beyond the end of skb->data for several bytes.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Dan Carpenter 2013-08-29 11:47:00 +03:00 committed by David S. Miller
parent 702821f4ea
commit 0d63c27d9e
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/isdn/mISDN/dsp_core.c
View File

@ -288,8 +288,10 @@ dsp_control_req(struct dsp *dsp, struct mISDNhead *hh, struct sk_buff *skb)
u8 *data;
int len;
if (skb->len < sizeof(int))
if (skb->len < sizeof(int)) {
printk(KERN_ERR "%s: PH_CONTROL message too short\n", __func__);
return -EINVAL;
}
cont = *((int *)skb->data);
len = skb->len - sizeof(int);
data = skb->data + sizeof(int);