diff options
| author | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2013-11-14 17:38:05 -0800 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2013-11-14 17:38:05 -0800 |
| commit | 42249094f79422fbf5ed4b54eeb48ff096809b8f (patch) | |
| tree | 91e6850c8c7e8cc284cf8bb6363f8662f84011f4 /drivers/usb/core/config.c | |
| parent | 936816161978ca716a56c5e553c68f25972b1e3a (diff) | |
| parent | 2c027b7c48a888ab173ba45babb4525e278375d9 (diff) | |
Merge branch 'next' into for-linus
Merge first round of changes for 3.13 merge window.
Diffstat (limited to 'drivers/usb/core/config.c')
| -rw-r--r-- | drivers/usb/core/config.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c index 7199adccf44..a6b2cabe793 100644 --- a/drivers/usb/core/config.c +++ b/drivers/usb/core/config.c @@ -424,7 +424,8 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE); if (config->desc.bDescriptorType != USB_DT_CONFIG || - config->desc.bLength < USB_DT_CONFIG_SIZE) { + config->desc.bLength < USB_DT_CONFIG_SIZE || + config->desc.bLength > size) { dev_err(ddev, "invalid descriptor for config index %d: " "type = 0x%X, length = %d\n", cfgidx, config->desc.bDescriptorType, config->desc.bLength); |