diff options
| -rw-r--r-- | drivers/net/irda/irda-usb.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c index cce82f101f50..e4ea61944c22 100644 --- a/drivers/net/irda/irda-usb.c +++ b/drivers/net/irda/irda-usb.c | |||
| @@ -1124,11 +1124,11 @@ static int stir421x_patch_device(struct irda_usb_cb *self) | |||
| 1124 | * The actual image starts after the "STMP" keyword | 1124 | * The actual image starts after the "STMP" keyword |
| 1125 | * so forward to the firmware header tag | 1125 | * so forward to the firmware header tag |
| 1126 | */ | 1126 | */ |
| 1127 | for (i = 0; (fw->data[i] != STIR421X_PATCH_END_OF_HDR_TAG) && | 1127 | for (i = 0; i < fw->size && fw->data[i] != |
| 1128 | (i < fw->size); i++) ; | 1128 | STIR421X_PATCH_END_OF_HDR_TAG; i++) ; |
| 1129 | /* here we check for the out of buffer case */ | 1129 | /* here we check for the out of buffer case */ |
| 1130 | if ((STIR421X_PATCH_END_OF_HDR_TAG == fw->data[i]) && | 1130 | if (i < STIR421X_PATCH_CODE_OFFSET && i < fw->size && |
| 1131 | (i < STIR421X_PATCH_CODE_OFFSET)) { | 1131 | STIR421X_PATCH_END_OF_HDR_TAG == fw->data[i]) { |
| 1132 | if (!memcmp(fw->data + i + 1, STIR421X_PATCH_STMP_TAG, | 1132 | if (!memcmp(fw->data + i + 1, STIR421X_PATCH_STMP_TAG, |
| 1133 | sizeof(STIR421X_PATCH_STMP_TAG) - 1)) { | 1133 | sizeof(STIR421X_PATCH_STMP_TAG) - 1)) { |
| 1134 | 1134 | ||
