diff options
| author | Dan Williams <dan.j.williams@intel.com> | 2017-11-15 16:56:11 -0800 |
|---|---|---|
| committer | Dan Williams <dan.j.williams@intel.com> | 2017-11-15 16:56:11 -0800 |
| commit | 4247f24c23589bcc3bc3490515ef8c9497e9ae55 (patch) | |
| tree | 89726a0e171c443a3e8def2992b56dbd8a21df21 /drivers/usb/core/message.c | |
| parent | 79ab67ede21f536851a99ea68ee6fc1f5435e055 (diff) | |
| parent | 9f586fff6574f6ecbf323f92d44ffaf0d96225fe (diff) | |
Merge branch 'for-4.15/dax' into libnvdimm-for-next
Diffstat (limited to 'drivers/usb/core/message.c')
| -rw-r--r-- | drivers/usb/core/message.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c index 4c38ea41ae96..371a07d874a3 100644 --- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c @@ -2069,6 +2069,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr, elength = 1; goto next_desc; } + if ((buflen < elength) || (elength < 3)) { + dev_err(&intf->dev, "invalid descriptor buffer length\n"); + break; + } if (buffer[1] != USB_DT_CS_INTERFACE) { dev_err(&intf->dev, "skipping garbage\n"); goto next_desc; |