firewire: cdev: disallow receive packets without header
authorClemens Ladisch <clemens@ladisch.de>
Wed, 31 Mar 2010 14:26:39 +0000 (16:26 +0200)
committerStefan Richter <stefanr@s5r6.in-berlin.de>
Sat, 10 Apr 2010 14:51:13 +0000 (16:51 +0200)
In receive contexts, reject packets with header_length==0.  This would
be an instruction to queue zero packets which would not make sense.

This prevents a division by zero in the OHCI driver.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
drivers/firewire/core-cdev.c

index 8be720b278b7a435d2c106794c2cd663438c92a7..bbb8160e2c999f9cb6fc86af22e2cbcbde2ab290 100644 (file)
@@ -968,7 +968,8 @@ static int ioctl_queue_iso(struct client *client, union ioctl_arg *arg)
                        if (ctx->header_size == 0) {
                                if (u.packet.header_length > 0)
                                        return -EINVAL;
-                       } else if (u.packet.header_length % ctx->header_size != 0) {
+                       } else if (u.packet.header_length == 0 ||
+                                  u.packet.header_length % ctx->header_size != 0) {
                                return -EINVAL;
                        }
                        header_length = 0;