Messages in this thread Patch in this message | | | Date | Sun, 06 Dec 2009 15:30:46 -0800 | From | Greg KH <> | Subject | [14/20] isdn: hfc_usb: Fix read buffer overflow |
| |
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------ From: Roel Kluin <roel.kluin@gmail.com>
commit 286e633ef0ff5bb63c07b4516665da8004966fec upstream.
Check whether index is within bounds before testing the element.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Cc: Karsten Keil <isdn@linux-pingi.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- drivers/isdn/hisax/hfc_usb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/isdn/hisax/hfc_usb.c +++ b/drivers/isdn/hisax/hfc_usb.c @@ -818,8 +818,8 @@ collect_rx_frame(usb_fifo * fifo, __u8 * } /* we have a complete hdlc packet */ if (finish) { - if ((!fifo->skbuff->data[fifo->skbuff->len - 1]) - && (fifo->skbuff->len > 3)) { + if (fifo->skbuff->len > 3 && + !fifo->skbuff->data[fifo->skbuff->len - 1]) { if (fifon == HFCUSB_D_RX) { DBG(HFCUSB_DBG_DCHANNEL,
| |