diff options
| author | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-04-30 08:59:57 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-04-30 08:59:57 -0700 |
| commit | 40caf5ea5a7d47f8a33e26b63ca81dea4b5109d2 (patch) | |
| tree | 3f879353d5cb69d2dee707108e4aaeae075f5a0c /drivers/ieee1394/raw1394.c | |
| parent | d6454706c382ab74e2ecad7803c434cc6bd30343 (diff) | |
| parent | bcfd09ee48f77a4fe903dbc3757e7af931998ce1 (diff) | |
| download | blackbird-op-linux-40caf5ea5a7d47f8a33e26b63ca81dea4b5109d2.tar.gz blackbird-op-linux-40caf5ea5a7d47f8a33e26b63ca81dea4b5109d2.zip | |
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6: (56 commits)
ieee1394: remove garbage from Kconfig
ieee1394: more help in Kconfig
ieee1394: ohci1394: Fix mistake in printk message.
ieee1394: ohci1394: remove unnecessary rcvPhyPkt bit flipping in LinkControl register
ieee1394: ohci1394: fix cosmetic problem in error logging
ieee1394: eth1394: send async streams at S100 on 1394b buses
ieee1394: eth1394: fix error path in module_init
ieee1394: eth1394: correct return codes in hard_start_xmit
ieee1394: eth1394: hard_start_xmit is called in atomic context
ieee1394: eth1394: some conditions are unlikely
ieee1394: eth1394: clean up fragment_overlap
ieee1394: eth1394: don't use alloc_etherdev
ieee1394: eth1394: omit useless set_mac_address callback
ieee1394: eth1394: CONFIG_INET is always defined
ieee1394: eth1394: allow MTU bigger than 1500
ieee1394: unexport highlevel_host_reset
ieee1394: eth1394: contain host reset
ieee1394: eth1394: shorter error messages
ieee1394: eth1394: correct a memset argument
ieee1394: eth1394: refactor .probe and .update
...
Diffstat (limited to 'drivers/ieee1394/raw1394.c')
| -rw-r--r-- | drivers/ieee1394/raw1394.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/ieee1394/raw1394.c b/drivers/ieee1394/raw1394.c index bb897a37d9f7..c6aefd9ad0e8 100644 --- a/drivers/ieee1394/raw1394.c +++ b/drivers/ieee1394/raw1394.c @@ -938,7 +938,8 @@ static int handle_async_send(struct file_info *fi, struct pending_request *req) int header_length = req->req.misc & 0xffff; int expect_response = req->req.misc >> 16; - if ((header_length > req->req.length) || (header_length < 12)) { + if (header_length > req->req.length || header_length < 12 || + header_length > FIELD_SIZEOF(struct hpsb_packet, header)) { req->req.error = RAW1394_ERROR_INVALID_ARG; req->req.length = 0; queue_complete_req(req); |
