diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2015-06-26 15:46:08 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2015-06-26 15:46:08 -0700 |
| commit | 23908db413eccd77084b09c9b0a4451dfb0524c0 (patch) | |
| tree | 646f21a92496bdc04175e95642b0ecb2dc3dd09e /drivers/staging/ozwpan/ozusbsvc1.c | |
| parent | 8d7804a2f03dbd34940fcb426450c730adf29dae (diff) | |
| parent | 53a20e9e378ecd52f0afa4b60f8f8c81b6f97c27 (diff) | |
| download | linux-23908db413eccd77084b09c9b0a4451dfb0524c0.tar.bz2 | |
Merge tag 'staging-4.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver updates from Greg KH:
"Here's the big, really big, staging tree patches for 4.2-rc1.
Loads of stuff in here, almost all just coding style fixes / churn,
and a few new drivers as well, one of which I just disabled from the
build a few minutes ago due to way too many build warnings.
Other than the one "disable this driver" patch, all of these have been
in linux-next for quite a while with no reported issues"
* tag 'staging-4.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (1163 commits)
staging: wilc1000: disable driver due to build warnings
Staging: rts5208: fix CHANGE_LINK_STATE value
Staging: sm750fb: ddk750_swi2c.c: Insert spaces before parenthesis
Staging: sm750fb: ddk750_swi2c.c: Place braces on correct lines
Staging: sm750fb: ddk750_swi2c.c: Insert spaces around operators
Staging: sm750fb: ddk750_swi2c.c: Replace spaces with tabs
Staging: sm750fb: ddk750_swi2c.h: Shorten lines to under 80 characters
Staging: sm750fb: ddk750_swi2c.h: Replace spaces with tabs
Staging: sm750fb: modedb.h: Shorten lines to under 80 characters
Staging: sm750fb: modedb.h: Replace spaces with tabs
staging: comedi: addi_apci_3120: rename 'this_board' variables
staging: comedi: addi_apci_1516: rename 'this_board' variables
staging: comedi: ni_atmio: cleanup ni_getboardtype()
staging: comedi: vmk80xx: sanity check context used to get the boardinfo
staging: comedi: vmk80xx: rename 'boardinfo' variables
staging: comedi: dt3000: rename 'this_board' variables
staging: comedi: adv_pci_dio: rename 'this_board' variables
staging: comedi: cb_pcidas64: rename 'thisboard' variables
staging: comedi: cb_pcidas: rename 'thisboard' variables
staging: comedi: me4000: rename 'thisboard' variables
...
Diffstat (limited to 'drivers/staging/ozwpan/ozusbsvc1.c')
| -rw-r--r-- | drivers/staging/ozwpan/ozusbsvc1.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c index f660bb198c65..301fee8625ed 100644 --- a/drivers/staging/ozwpan/ozusbsvc1.c +++ b/drivers/staging/ozwpan/ozusbsvc1.c @@ -342,12 +342,16 @@ static void oz_usb_handle_ep_data(struct oz_usb_ctx *usb_ctx, case OZ_DATA_F_ISOC_FIXED: { struct oz_isoc_fixed *body = (struct oz_isoc_fixed *)data_hdr; - int data_len = len-sizeof(struct oz_isoc_fixed)+1; + int data_len; int unit_size = body->unit_size; u8 *data = body->data; int count; int i; + if (len < sizeof(struct oz_isoc_fixed) - 1) + break; + data_len = len - (sizeof(struct oz_isoc_fixed) - 1); + if (!unit_size) break; count = data_len/unit_size; @@ -427,6 +431,11 @@ void oz_usb_rx(struct oz_pd *pd, struct oz_elt *elt) case OZ_VENDOR_CLASS_RSP: { struct oz_vendor_class_rsp *body = (struct oz_vendor_class_rsp *)usb_hdr; + + if (elt->length < + sizeof(struct oz_vendor_class_rsp) - 1) + break; + oz_hcd_control_cnf(usb_ctx->hport, body->req_id, body->rcode, body->data, elt->length- sizeof(struct oz_vendor_class_rsp)+1); |