Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0d63c27d authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller
Browse files

mISDN: return -EINVAL on error in dsp_control_req() 



If skb->len is too short then we should return an error.  Otherwise we
read beyond the end of skb->data for several bytes.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 702821f4

drivers/isdn/mISDN/dsp_core.c

+3 −1
Original line number Diff line number Diff line
@@ -288,8 +288,10 @@ dsp_control_req(struct dsp *dsp, struct mISDNhead *hh, struct sk_buff *skb) 
	u8 *data;

	int len;



	if (skb->len < sizeof(int))

	if (skb->len < sizeof(int)) {

		printk(KERN_ERR "%s: PH_CONTROL message too short\n", __func__);

		return -EINVAL;

	}

	cont = *((int *)skb->data);

	len = skb->len - sizeof(int);

	data = skb->data + sizeof(int);