diff options
| author | Roel Kluin <roel.kluin@gmail.com> | 2009-09-02 11:20:27 +0200 |
|---|---|---|
| committer | Samuel Ortiz <sameo@linux.intel.com> | 2009-09-02 11:20:27 +0200 |
| commit | 1d71d682e1e4c6639f6c28042a1a2bc73c5e0554 (patch) | |
| tree | 6ab67c92b4cba19b9faac620b343f7ec71936ebb /drivers | |
| parent | 2fbd3da3877ad8d923b055e5996f80b4d4a6daf4 (diff) | |
irda: test index before read in stir421x_patch_device()
Test whether index exceeds fw->size before reading the element
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/irda/irda-usb.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c index 0c0831c03f64..0b97bbd5b69a 100644 --- a/drivers/net/irda/irda-usb.c +++ b/drivers/net/irda/irda-usb.c @@ -1122,11 +1122,12 @@ static int stir421x_patch_device(struct irda_usb_cb *self) * The actual image starts after the "STMP" keyword * so forward to the firmware header tag */ - for (i = 0; (fw->data[i] != STIR421X_PATCH_END_OF_HDR_TAG) - && (i < fw->size); i++) ; + for (i = 0; i < fw->size && fw->data[i] != + STIR421X_PATCH_END_OF_HDR_TAG; i++) + ; /* here we check for the out of buffer case */ - if ((STIR421X_PATCH_END_OF_HDR_TAG == fw->data[i]) - && (i < STIR421X_PATCH_CODE_OFFSET)) { + if (i < STIR421X_PATCH_CODE_OFFSET && i < fw->size && + STIR421X_PATCH_END_OF_HDR_TAG == fw->data[i]) { if (!memcmp(fw->data + i + 1, STIR421X_PATCH_STMP_TAG, sizeof(STIR421X_PATCH_STMP_TAG) - 1)) { |