From patchwork Mon Oct 11 00:25:00 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Samuel Ortiz X-Patchwork-Id: 67372 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 1890CB70A3 for ; Mon, 11 Oct 2010 11:26:03 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752601Ab0JKAZ7 (ORCPT ); Sun, 10 Oct 2010 20:25:59 -0400 Received: from mga02.intel.com ([134.134.136.20]:54297 "EHLO mga02.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751042Ab0JKAZ6 (ORCPT ); Sun, 10 Oct 2010 20:25:58 -0400 Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga101.jf.intel.com with ESMTP; 10 Oct 2010 17:25:54 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="4.57,311,1283756400"; d="scan'208";a="666042488" Received: from unknown (HELO sortiz-mobl) ([10.255.18.201]) by orsmga001.jf.intel.com with ESMTP; 10 Oct 2010 17:25:53 -0700 From: Samuel Ortiz To: "David S. Miller" Cc: netdev@vger.kernel.org, Roel Kluin , Samuel Ortiz Subject: [PATCH net-next 3/5] irda: Test index before read in stir421x_patch_device() Date: Mon, 11 Oct 2010 02:25:00 +0200 Message-Id: <3b06dbbeadb6488cd00999b61b080bb6f0218503.1286756123.git.sameo@linux.intel.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: References: In-Reply-To: References: Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Roel Kluin Test whether index exceeds fw->size before reading the element Signed-off-by: Roel Kluin Signed-off-by: Samuel Ortiz --- drivers/net/irda/irda-usb.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c index cce82f1..e4ea619 100644 --- a/drivers/net/irda/irda-usb.c +++ b/drivers/net/irda/irda-usb.c @@ -1124,11 +1124,11 @@ static int stir421x_patch_device(struct irda_usb_cb *self) * The actual image starts after the "STMP" keyword * so forward to the firmware header tag */ - for (i = 0; (fw->data[i] != STIR421X_PATCH_END_OF_HDR_TAG) && - (i < fw->size); i++) ; + for (i = 0; i < fw->size && fw->data[i] != + STIR421X_PATCH_END_OF_HDR_TAG; i++) ; /* here we check for the out of buffer case */ - if ((STIR421X_PATCH_END_OF_HDR_TAG == fw->data[i]) && - (i < STIR421X_PATCH_CODE_OFFSET)) { + if (i < STIR421X_PATCH_CODE_OFFSET && i < fw->size && + STIR421X_PATCH_END_OF_HDR_TAG == fw->data[i]) { if (!memcmp(fw->data + i + 1, STIR421X_PATCH_STMP_TAG, sizeof(STIR421X_PATCH_STMP_TAG) - 1)) {