diff options
| author | Kevin Hilman <khilman@linaro.org> | 2015-07-06 11:16:48 -0700 |
|---|---|---|
| committer | Kevin Hilman <khilman@linaro.org> | 2015-07-06 11:16:48 -0700 |
| commit | c1c767d29bb2390308a35b69957b874e9446fe3b (patch) | |
| tree | 6014e0b0838b2536c72452be4c5f5b2102922d04 /drivers/staging/ozwpan/ozusbsvc1.c | |
| parent | 2cb9802eeb7f919f97df05b16ec128f4f5af366d (diff) | |
| parent | 165797d05c15ab87ef7421c63a076ffa8477cbe4 (diff) | |
Merge tag 'v3.14.45' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable into linux-linaro-lsk-v3.14lsk-v3.14-15.07
This is the 3.14.45 stable release
Diffstat (limited to 'drivers/staging/ozwpan/ozusbsvc1.c')
| -rw-r--r-- | drivers/staging/ozwpan/ozusbsvc1.c | 19 |
1 files changed, 14 insertions, 5 deletions
diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c index 617f51cdaea7..b58e87e951e7 100644 --- a/drivers/staging/ozwpan/ozusbsvc1.c +++ b/drivers/staging/ozwpan/ozusbsvc1.c @@ -323,7 +323,11 @@ static void oz_usb_handle_ep_data(struct oz_usb_ctx *usb_ctx, struct oz_multiple_fixed *body = (struct oz_multiple_fixed *)data_hdr; u8 *data = body->data; - int n = (len - sizeof(struct oz_multiple_fixed)+1) + unsigned int n; + if (!body->unit_size || + len < sizeof(struct oz_multiple_fixed) - 1) + break; + n = (len - (sizeof(struct oz_multiple_fixed) - 1)) / body->unit_size; while (n--) { oz_hcd_data_ind(usb_ctx->hport, body->endpoint, @@ -386,10 +390,15 @@ void oz_usb_rx(struct oz_pd *pd, struct oz_elt *elt) case OZ_GET_DESC_RSP: { struct oz_get_desc_rsp *body = (struct oz_get_desc_rsp *)usb_hdr; - int data_len = elt->length - - sizeof(struct oz_get_desc_rsp) + 1; - u16 offs = le16_to_cpu(get_unaligned(&body->offset)); - u16 total_size = + u16 offs, total_size; + u8 data_len; + + if (elt->length < sizeof(struct oz_get_desc_rsp) - 1) + break; + data_len = elt->length - + (sizeof(struct oz_get_desc_rsp) - 1); + offs = le16_to_cpu(get_unaligned(&body->offset)); + total_size = le16_to_cpu(get_unaligned(&body->total_size)); oz_dbg(ON, "USB_REQ_GET_DESCRIPTOR - cnf\n"); oz_hcd_get_desc_cnf(usb_ctx->hport, body->req_id, |