summaryrefslogtreecommitdiff
path: root/drivers/net/can/usb
diff options
context:
space:
mode:
authorMaximilian Schneider <max@schneidersoft.net>2013-07-02 23:43:29 +0000
committerMarc Kleine-Budde <mkl@pengutronix.de>2013-07-19 14:55:13 +0200
commit233a26e85f9a72bcd0cdb7a95d1d5abcd052369f (patch)
tree56048ef7b8a0ccac8fac41542259d107d0cc1e2e /drivers/net/can/usb
parentecb2cf1a6b63825a258ff4fe0d7f3070fbe4676b (diff)
net: can: esd_usb2: check index of array before accessing
The esd_usb2_read_bulk_callback() function is parsing the data that comes from the USB CAN adapter. One datum is used as an index to access the dev->nets[] array. This patch adds the missing bounds checking. Acked-by: Matthias Fuchs <matthias.fuchs@esd.eu> Signed-off-by: Maximilian Schneider <max@schneidersoft.net> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Diffstat (limited to 'drivers/net/can/usb')
-rw-r--r--drivers/net/can/usb/esd_usb2.c10
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index 6aa7b3266c80..ac6177d3befc 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -412,10 +412,20 @@ static void esd_usb2_read_bulk_callback(struct urb *urb)
switch (msg->msg.hdr.cmd) {
case CMD_CAN_RX:
+ if (msg->msg.rx.net >= dev->net_count) {
+ dev_err(dev->udev->dev.parent, "format error\n");
+ break;
+ }
+
esd_usb2_rx_can_msg(dev->nets[msg->msg.rx.net], msg);
break;
case CMD_CAN_TX:
+ if (msg->msg.txdone.net >= dev->net_count) {
+ dev_err(dev->udev->dev.parent, "format error\n");
+ break;
+ }
+
esd_usb2_tx_done_msg(dev->nets[msg->msg.txdone.net],
msg);
break;