summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorStephane Grosjean <s.grosjean@peak-system.com>2013-08-09 11:44:06 +0200
committerDavid S. Miller <davem@davemloft.net>2013-08-11 21:51:49 -0700
commit3c322a56b01695df15c70bfdc2d02e0ccd80654e (patch)
tree3da6918ee3ce3e41f40395214aa15c27f50c176a /drivers
parent29d7919692e591c2f0e1f743a7f6c613c1266ece (diff)
can: pcan_usb: fix wrong memcpy() bytes length
Fix possibly wrong memcpy() bytes length since some CAN records received from PCAN-USB could define a DLC field in range [9..15]. In that case, the real DLC value MUST be used to move forward the record pointer but, only 8 bytes max. MUST be copied into the data field of the struct can_frame object of the skb given to the network core. Cc: linux-stable <stable@vger.kernel.org> Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/can/usb/peak_usb/pcan_usb.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
index 25723d8ee201..925ab8ec9329 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
@@ -649,7 +649,7 @@ static int pcan_usb_decode_data(struct pcan_usb_msg_context *mc, u8 status_len)
if ((mc->ptr + rec_len) > mc->end)
goto decode_failed;
- memcpy(cf->data, mc->ptr, rec_len);
+ memcpy(cf->data, mc->ptr, cf->can_dlc);
mc->ptr += rec_len;
}