Skip to contentSkip to conversation

mISDN: return -EINVAL on error in dsp_control_req()

PATCH Applied Dan Carpenter 2 participants 2 messages Aug 29, 2013 – Aug 30, 2013

Subsystems (3)
Networking Network drivers Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 mISDN: return -EINVAL on error in dsp_control_req()

If skb->len is too short then we should return an error. Otherwise we read beyond the end of skb->data for several bytes.

Signed-off-by Dan Carpenter <[email protected]>
drivers/isdn/mISDN/dsp_core.c +3 -1
index 22b720e..77025f5 100644
@@ -288,8 +288,10 @@ dsp_control_req(struct dsp *dsp, struct mISDNhead *hh, struct sk_buff *skb)
 	u8 *data;
 	int len;
 
-	if (skb->len < sizeof(int))
+	if (skb->len < sizeof(int)) {
 		printk(KERN_ERR "%s: PH_CONTROL message too short\n", __func__);
+		return -EINVAL;
+	}
 	cont = *((int *)skb->data);
 	len = skb->len - sizeof(int);
 	data = skb->data + sizeof(int);