mISDN: return -EINVAL on error in dsp_control_req()
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 29 Aug 2013 08:47:00 +0000 (11:47 +0300)
committerDavid S. Miller <davem@davemloft.net>
Fri, 30 Aug 2013 21:52:44 +0000 (17:52 -0400)
If skb->len is too short then we should return an error.  Otherwise we
read beyond the end of skb->data for several bytes.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/isdn/mISDN/dsp_core.c

index 22b720ec80cbc49b216b934045175aae3d03b2fd..77025f5cb57df7edbee7b8d342bd1c67645665d6 100644 (file)
@@ -288,8 +288,10 @@ dsp_control_req(struct dsp *dsp, struct mISDNhead *hh, struct sk_buff *skb)
        u8 *data;
        int len;
 
-       if (skb->len < sizeof(int))
+       if (skb->len < sizeof(int)) {
                printk(KERN_ERR "%s: PH_CONTROL message too short\n", __func__);
+               return -EINVAL;
+       }
        cont = *((int *)skb->data);
        len = skb->len - sizeof(int);
        data = skb->data + sizeof(int);