Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 01a60e76 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

USB: keyspan: add a sanity test on "len" 



"len" comes from the USB transfer and it's probably correct.  The thing
is that we already have similar checks like:

        if (data[i] >= serial->num_ports) {

So adding a sanity test here matches the rest of the code and is a good
idea.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 6a3ae841

drivers/usb/serial/keyspan.c

+3 −2
Original line number Diff line number Diff line
@@ -741,14 +741,15 @@ static void usa49wg_indat_callback(struct urb *urb) 
		if ((data[i] & 0x80) == 0) {

			/* no error on any byte */

			i++;

			for (x = 1; x < len ; ++x)

			for (x = 1; x < len && i < urb->actual_length; ++x)

				tty_insert_flip_char(&port->port,

						data[i++], 0);

		} else {

			/*

			 * some bytes had errors, every byte has status

			 */

			for (x = 0; x + 1 < len; x += 2) {

			for (x = 0; x + 1 < len &&

				    i + 1 < urb->actual_length; x += 2) {

				int stat = data[i], flag = 0;



				if (stat & RXERROR_OVERRUN)