Commit 233a26e8 authored Jul 02, 2013 by Maximilian Schneider Committed by Marc Kleine-Budde Jul 19, 2013

net: can: esd_usb2: check index of array before accessing



The esd_usb2_read_bulk_callback() function is parsing the data that comes from
the USB CAN adapter. One datum is used as an index to access the dev->nets[]
array. This patch adds the missing bounds checking.

Acked-by: Matthias Fuchs <matthias.fuchs@esd.eu>
Signed-off-by: Maximilian Schneider <max@schneidersoft.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

parent ecb2cf1a

drivers/net/can/usb/esd_usb2.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -412,10 +412,20 @@ static void esd_usb2_read_bulk_callback(struct urb *urb)

		switch (msg->msg.hdr.cmd) {
		case CMD_CAN_RX:
		if (msg->msg.rx.net >= dev->net_count) {
		dev_err(dev->udev->dev.parent, "format error\n");
		break;
		}

		esd_usb2_rx_can_msg(dev->nets[msg->msg.rx.net], msg);
		break;

		case CMD_CAN_TX:
		if (msg->msg.txdone.net >= dev->net_count) {
		dev_err(dev->udev->dev.parent, "format error\n");
		break;
		}

		esd_usb2_tx_done_msg(dev->nets[msg->msg.txdone.net],
		msg);
		break;