Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e5fcdb7e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6 

* 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
  n_gsm: gsm_data_alloc buffer allocation could fail and it is not being checked
  n_gsm: Fix message length handling when building header
parents 7bddaaca 093d8046

drivers/tty/n_gsm.c

+4 −2
Original line number Diff line number Diff line
@@ -716,8 +716,8 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg) 
		if (msg->len < 128)

			*--dp = (msg->len << 1) | EA;

		else {

			*--dp = ((msg->len & 127) << 1) | EA;

			*--dp = (msg->len >> 6) & 0xfe;

			*--dp = (msg->len >> 7);	/* bits 7 - 15 */

			*--dp = (msg->len & 127) << 1;	/* bits 0 - 6 */

		}

	}
@@ -968,6 +968,8 @@ static void gsm_control_reply(struct gsm_mux *gsm, int cmd, u8 *data, 
{

	struct gsm_msg *msg;

	msg = gsm_data_alloc(gsm, 0, dlen + 2, gsm->ftype);

	if (msg == NULL)

		return;

	msg->data[0] = (cmd & 0xFE) << 1 | EA;	/* Clear C/R */

	msg->data[1] = (dlen << 1) | EA;

	memcpy(msg->data + 2, data, dlen);