summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2013-08-29 12:47:00 +0400
committerDavid S. Miller <davem@davemloft.net>2013-08-31 01:52:44 +0400
commit0d63c27d9e879a0b54eb405636d60ab12040ca46 (patch)
treedd6f8abace89f2bd7b4c0bf988439eccc3956691 /drivers
parent702821f4ea6f68db18aa1de7d8ed62c6ba586a64 (diff)
downloadlinux-0d63c27d9e879a0b54eb405636d60ab12040ca46.tar.xz
mISDN: return -EINVAL on error in dsp_control_req()
If skb->len is too short then we should return an error. Otherwise we read beyond the end of skb->data for several bytes. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/isdn/mISDN/dsp_core.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/isdn/mISDN/dsp_core.c b/drivers/isdn/mISDN/dsp_core.c
index 22b720ec80cb..77025f5cb57d 100644
--- a/drivers/isdn/mISDN/dsp_core.c
+++ b/drivers/isdn/mISDN/dsp_core.c
@@ -288,8 +288,10 @@ dsp_control_req(struct dsp *dsp, struct mISDNhead *hh, struct sk_buff *skb)
u8 *data;
int len;
- if (skb->len < sizeof(int))
+ if (skb->len < sizeof(int)) {
printk(KERN_ERR "%s: PH_CONTROL message too short\n", __func__);
+ return -EINVAL;
+ }
cont = *((int *)skb->data);
len = skb->len - sizeof(int);
data = skb->data + sizeof(int);