diff options
author | Maximilian Schneider <max@schneidersoft.net> | 2013-07-02 19:43:29 -0400 |
---|---|---|
committer | Marc Kleine-Budde <mkl@pengutronix.de> | 2013-07-19 08:55:13 -0400 |
commit | 233a26e85f9a72bcd0cdb7a95d1d5abcd052369f (patch) | |
tree | 56048ef7b8a0ccac8fac41542259d107d0cc1e2e | |
parent | ecb2cf1a6b63825a258ff4fe0d7f3070fbe4676b (diff) |
net: can: esd_usb2: check index of array before accessing
The esd_usb2_read_bulk_callback() function is parsing the data that comes from
the USB CAN adapter. One datum is used as an index to access the dev->nets[]
array. This patch adds the missing bounds checking.
Acked-by: Matthias Fuchs <matthias.fuchs@esd.eu>
Signed-off-by: Maximilian Schneider <max@schneidersoft.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
-rw-r--r-- | drivers/net/can/usb/esd_usb2.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c index 6aa7b3266c80..ac6177d3befc 100644 --- a/drivers/net/can/usb/esd_usb2.c +++ b/drivers/net/can/usb/esd_usb2.c | |||
@@ -412,10 +412,20 @@ static void esd_usb2_read_bulk_callback(struct urb *urb) | |||
412 | 412 | ||
413 | switch (msg->msg.hdr.cmd) { | 413 | switch (msg->msg.hdr.cmd) { |
414 | case CMD_CAN_RX: | 414 | case CMD_CAN_RX: |
415 | if (msg->msg.rx.net >= dev->net_count) { | ||
416 | dev_err(dev->udev->dev.parent, "format error\n"); | ||
417 | break; | ||
418 | } | ||
419 | |||
415 | esd_usb2_rx_can_msg(dev->nets[msg->msg.rx.net], msg); | 420 | esd_usb2_rx_can_msg(dev->nets[msg->msg.rx.net], msg); |
416 | break; | 421 | break; |
417 | 422 | ||
418 | case CMD_CAN_TX: | 423 | case CMD_CAN_TX: |
424 | if (msg->msg.txdone.net >= dev->net_count) { | ||
425 | dev_err(dev->udev->dev.parent, "format error\n"); | ||
426 | break; | ||
427 | } | ||
428 | |||
419 | esd_usb2_tx_done_msg(dev->nets[msg->msg.txdone.net], | 429 | esd_usb2_tx_done_msg(dev->nets[msg->msg.txdone.net], |
420 | msg); | 430 | msg); |
421 | break; | 431 | break; |