diff options
Diffstat (limited to 'drivers/ieee1394/raw1394.c')
| -rw-r--r-- | drivers/ieee1394/raw1394.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/ieee1394/raw1394.c b/drivers/ieee1394/raw1394.c index bb897a37d9f..d382500f421 100644 --- a/drivers/ieee1394/raw1394.c +++ b/drivers/ieee1394/raw1394.c @@ -35,7 +35,6 @@ #include <linux/poll.h> #include <linux/module.h> #include <linux/init.h> -#include <linux/smp_lock.h> #include <linux/interrupt.h> #include <linux/vmalloc.h> #include <linux/cdev.h> @@ -938,7 +937,8 @@ static int handle_async_send(struct file_info *fi, struct pending_request *req) int header_length = req->req.misc & 0xffff; int expect_response = req->req.misc >> 16; - if ((header_length > req->req.length) || (header_length < 12)) { + if (header_length > req->req.length || header_length < 12 || + header_length > FIELD_SIZEOF(struct hpsb_packet, header)) { req->req.error = RAW1394_ERROR_INVALID_ARG; req->req.length = 0; queue_complete_req(req); |