diff options
| author | Wolfram Sang <wsa@the-dreams.de> | 2017-10-26 22:24:15 +0200 |
|---|---|---|
| committer | Wolfram Sang <wsa@the-dreams.de> | 2017-10-26 22:24:15 +0200 |
| commit | 3990bedea6e96cb1f182dbeadd62215dbb9e1c85 (patch) | |
| tree | 90ac0ab8ae1d4339dc17eb42a853042ea06d6b13 /drivers/usb/core/message.c | |
| parent | 631de7a4603439eaa1d7a2a1a7b5b49edcd87f67 (diff) | |
| parent | 3997fb74846f35d0364c5e88e54bc9b166d5a1bc (diff) | |
Merge branch 'i2c-mux/for-next' of https://github.com/peda-r/i2c-mux into i2c/for-4.15
This cycle has been real quiet for me. There's only the one trivial
patch that somewhat simplifies DT parsing in the i2c-mux-reg driver.
Diffstat (limited to 'drivers/usb/core/message.c')
| -rw-r--r-- | drivers/usb/core/message.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c index 4c38ea41ae96..371a07d874a3 100644 --- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c @@ -2069,6 +2069,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr, elength = 1; goto next_desc; } + if ((buflen < elength) || (elength < 3)) { + dev_err(&intf->dev, "invalid descriptor buffer length\n"); + break; + } if (buffer[1] != USB_DT_CS_INTERFACE) { dev_err(&intf->dev, "skipping garbage\n"); goto next_desc; |