| From 286e633ef0ff5bb63c07b4516665da8004966fec Mon Sep 17 00:00:00 2001 |
| From: Roel Kluin <roel.kluin@gmail.com> |
| Date: Wed, 4 Nov 2009 08:31:59 -0800 |
| Subject: isdn: hfc_usb: Fix read buffer overflow |
| |
| From: Roel Kluin <roel.kluin@gmail.com> |
| |
| commit 286e633ef0ff5bb63c07b4516665da8004966fec upstream. |
| |
| Check whether index is within bounds before testing the element. |
| |
| Signed-off-by: Roel Kluin <roel.kluin@gmail.com> |
| Cc: Karsten Keil <isdn@linux-pingi.de> |
| Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| drivers/isdn/hisax/hfc_usb.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/isdn/hisax/hfc_usb.c |
| +++ b/drivers/isdn/hisax/hfc_usb.c |
| @@ -818,8 +818,8 @@ collect_rx_frame(usb_fifo * fifo, __u8 * |
| } |
| /* we have a complete hdlc packet */ |
| if (finish) { |
| - if ((!fifo->skbuff->data[fifo->skbuff->len - 1]) |
| - && (fifo->skbuff->len > 3)) { |
| + if (fifo->skbuff->len > 3 && |
| + !fifo->skbuff->data[fifo->skbuff->len - 1]) { |
| |
| if (fifon == HFCUSB_D_RX) { |
| DBG(HFCUSB_DBG_DCHANNEL, |
