mISDN: return -EINVAL on error in dsp_control_req()

If skb->len is too short then we should return an error.  Otherwise we
read beyond the end of skb->data for several bytes.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 3 insertions, 1 deletions

diff --git a/drivers/isdn/mISDN/dsp_core.c b/drivers/isdn/mISDN/dsp_core.c
index 22b720ec80cb..77025f5cb57d 100644
--- a/drivers/isdn/mISDN/dsp_core.c
+++ b/drivers/isdn/mISDN/dsp_core.c
@@ -288,8 +288,10 @@ dsp_control_req(struct dsp *dsp, struct mISDNhead *hh, struct sk_buff *skb)
         u8 *data;
         int len;
 
-        if (skb->len < sizeof(int))
+        if (skb->len < sizeof(int)) {
                 printk(KERN_ERR "%s: PH_CONTROL message too short\n", __func__);
+                return -EINVAL;
+        }
         cont = *((int *)skb->data);
         len = skb->len - sizeof(int);
         data = skb->data + sizeof(int);