aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/ieee1394/raw1394.c
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/ieee1394/raw1394.c')
-rw-r--r--drivers/ieee1394/raw1394.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/ieee1394/raw1394.c b/drivers/ieee1394/raw1394.c
index bb897a37d9f7..c6aefd9ad0e8 100644
--- a/drivers/ieee1394/raw1394.c
+++ b/drivers/ieee1394/raw1394.c
@@ -938,7 +938,8 @@ static int handle_async_send(struct file_info *fi, struct pending_request *req)
938 int header_length = req->req.misc & 0xffff; 938 int header_length = req->req.misc & 0xffff;
939 int expect_response = req->req.misc >> 16; 939 int expect_response = req->req.misc >> 16;
940 940
941 if ((header_length > req->req.length) || (header_length < 12)) { 941 if (header_length > req->req.length || header_length < 12 ||
942 header_length > FIELD_SIZEOF(struct hpsb_packet, header)) {
942 req->req.error = RAW1394_ERROR_INVALID_ARG; 943 req->req.error = RAW1394_ERROR_INVALID_ARG;
943 req->req.length = 0; 944 req->req.length = 0;
944 queue_complete_req(req); 945 queue_complete_req(req);