Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3b06dbbe authored by Roel Kluin's avatar Roel Kluin Committed by Samuel Ortiz
Browse files

irda: Test index before read in stir421x_patch_device() 



Test whether index exceeds fw->size before reading the element

Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarSamuel Ortiz <samuel@sortiz.org>
parent f8cba16c

drivers/net/irda/irda-usb.c

+4 −4
Original line number Diff line number Diff line
@@ -1124,11 +1124,11 @@ static int stir421x_patch_device(struct irda_usb_cb *self) 
                 * The actual image starts after the "STMP" keyword

                 * so forward to the firmware header tag

                 */

                for (i = 0; (fw->data[i] != STIR421X_PATCH_END_OF_HDR_TAG) &&

			     (i < fw->size); i++) ;

                for (i = 0; i < fw->size && fw->data[i] !=

			     STIR421X_PATCH_END_OF_HDR_TAG; i++) ;

                /* here we check for the out of buffer case */

                if ((STIR421X_PATCH_END_OF_HDR_TAG == fw->data[i]) &&

                    (i < STIR421X_PATCH_CODE_OFFSET)) {

                if (i < STIR421X_PATCH_CODE_OFFSET && i < fw->size &&

				STIR421X_PATCH_END_OF_HDR_TAG == fw->data[i]) {

                        if (!memcmp(fw->data + i + 1, STIR421X_PATCH_STMP_TAG,

                                    sizeof(STIR421X_PATCH_STMP_TAG) - 1)) {