diff options
| author | David S. Miller | 2015-06-09 05:06:56 +0200 |
|---|---|---|
| committer | David S. Miller | 2015-06-09 05:06:56 +0200 |
| commit | 941742f49762ba4c908510f036b09a46c1b14513 (patch) | |
| tree | aafb7a72c2072f98889406668003234bed56df02 /drivers/staging/ozwpan/ozusbsvc1.c | |
| parent | net: phy: dp83867: Fix device tree entries (diff) | |
| parent | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (diff) | |
| download | kernel-qcow2-linux-941742f49762ba4c908510f036b09a46c1b14513.tar.gz kernel-qcow2-linux-941742f49762ba4c908510f036b09a46c1b14513.tar.xz kernel-qcow2-linux-941742f49762ba4c908510f036b09a46c1b14513.zip | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Diffstat (limited to 'drivers/staging/ozwpan/ozusbsvc1.c')
| -rw-r--r-- | drivers/staging/ozwpan/ozusbsvc1.c | 19 |
1 files changed, 14 insertions, 5 deletions
diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c index d434d8c6fff6..f660bb198c65 100644 --- a/drivers/staging/ozwpan/ozusbsvc1.c +++ b/drivers/staging/ozwpan/ozusbsvc1.c @@ -326,7 +326,11 @@ static void oz_usb_handle_ep_data(struct oz_usb_ctx *usb_ctx, struct oz_multiple_fixed *body = (struct oz_multiple_fixed *)data_hdr; u8 *data = body->data; - int n = (len - sizeof(struct oz_multiple_fixed)+1) + unsigned int n; + if (!body->unit_size || + len < sizeof(struct oz_multiple_fixed) - 1) + break; + n = (len - (sizeof(struct oz_multiple_fixed) - 1)) / body->unit_size; while (n--) { oz_hcd_data_ind(usb_ctx->hport, body->endpoint, @@ -390,10 +394,15 @@ void oz_usb_rx(struct oz_pd *pd, struct oz_elt *elt) case OZ_GET_DESC_RSP: { struct oz_get_desc_rsp *body = (struct oz_get_desc_rsp *)usb_hdr; - int data_len = elt->length - - sizeof(struct oz_get_desc_rsp) + 1; - u16 offs = le16_to_cpu(get_unaligned(&body->offset)); - u16 total_size = + u16 offs, total_size; + u8 data_len; + + if (elt->length < sizeof(struct oz_get_desc_rsp) - 1) + break; + data_len = elt->length - + (sizeof(struct oz_get_desc_rsp) - 1); + offs = le16_to_cpu(get_unaligned(&body->offset)); + total_size = le16_to_cpu(get_unaligned(&body->total_size)); oz_dbg(ON, "USB_REQ_GET_DESCRIPTOR - cnf\n"); oz_hcd_get_desc_cnf(usb_ctx->hport, body->req_id, |