diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-04-05 08:43:20 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-04-05 14:11:25 -0700 |
| commit | 01a60e76b6392547ad3dca3ac05b9c886fa5da45 (patch) | |
| tree | 5fe22932e6ad9f325e43a374d3cd5376117fd047 /drivers/usb/serial | |
| parent | 6a3ae8412f9e9cee0e8647954f4f7f2c50664ca2 (diff) | |
| download | op-kernel-dev-01a60e76b6392547ad3dca3ac05b9c886fa5da45.zip op-kernel-dev-01a60e76b6392547ad3dca3ac05b9c886fa5da45.tar.gz | |
USB: keyspan: add a sanity test on "len"
"len" comes from the USB transfer and it's probably correct. The thing
is that we already have similar checks like:
if (data[i] >= serial->num_ports) {
So adding a sanity test here matches the rest of the code and is a good
idea.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/serial')
| -rw-r--r-- | drivers/usb/serial/keyspan.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c index 3d92394..025310b 100644 --- a/drivers/usb/serial/keyspan.c +++ b/drivers/usb/serial/keyspan.c @@ -741,14 +741,15 @@ static void usa49wg_indat_callback(struct urb *urb) if ((data[i] & 0x80) == 0) { /* no error on any byte */ i++; - for (x = 1; x < len ; ++x) + for (x = 1; x < len && i < urb->actual_length; ++x) tty_insert_flip_char(&port->port, data[i++], 0); } else { /* * some bytes had errors, every byte has status */ - for (x = 0; x + 1 < len; x += 2) { + for (x = 0; x + 1 < len && + i + 1 < urb->actual_length; x += 2) { int stat = data[i], flag = 0; if (stat & RXERROR_OVERRUN) |
