diff options
| author | Wim Van Sebroeck <wim@iguana.be> | 2007-05-01 06:53:01 +0000 |
|---|---|---|
| committer | Wim Van Sebroeck <wim@iguana.be> | 2007-05-01 06:53:01 +0000 |
| commit | 48a7afe314bfc4d7f50e1608632f503dbba7e013 (patch) | |
| tree | 4a80e6b96321a71affd1bacea817de93be08894b /drivers/ieee1394/raw1394.c | |
| parent | fb8f7ba077b5c665432082ab205bcd2cb01f6a3c (diff) | |
| parent | dc87c3985e9b442c60994308a96f887579addc39 (diff) | |
Merge /pub/scm/linux/kernel/git/torvalds/linux-2.6
Diffstat (limited to 'drivers/ieee1394/raw1394.c')
| -rw-r--r-- | drivers/ieee1394/raw1394.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/ieee1394/raw1394.c b/drivers/ieee1394/raw1394.c index bb897a37d9f..c6aefd9ad0e 100644 --- a/drivers/ieee1394/raw1394.c +++ b/drivers/ieee1394/raw1394.c @@ -938,7 +938,8 @@ static int handle_async_send(struct file_info *fi, struct pending_request *req) int header_length = req->req.misc & 0xffff; int expect_response = req->req.misc >> 16; - if ((header_length > req->req.length) || (header_length < 12)) { + if (header_length > req->req.length || header_length < 12 || + header_length > FIELD_SIZEOF(struct hpsb_packet, header)) { req->req.error = RAW1394_ERROR_INVALID_ARG; req->req.length = 0; queue_complete_req(req); |