Commit 286e633e authored Nov 04, 2009 by Roel Kluin Committed by David S. Miller Nov 04, 2009

isdn: hfc_usb: Fix read buffer overflow



Check whether index is within bounds before testing the element.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Cc: Karsten Keil <isdn@linux-pingi.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent a947c8f0

drivers/isdn/hisax/hfc_usb.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -817,8 +817,8 @@ collect_rx_frame(usb_fifo * fifo, __u8 * data, int len, int finish)
		}
		/* we have a complete hdlc packet */
		if (finish) {
		if ((!fifo->skbuff->data[fifo->skbuff->len - 1])
		&& (fifo->skbuff->len > 3)) {
		if (fifo->skbuff->len > 3 &&
		!fifo->skbuff->data[fifo->skbuff->len - 1]) {

		if (fifon == HFCUSB_D_RX) {
		DBG(HFCUSB_DBG_DCHANNEL,

Admin message