diff options
| author | Wolfram Sang <wsa@the-dreams.de> | 2018-12-11 20:58:20 +0100 |
|---|---|---|
| committer | Wolfram Sang <wsa@the-dreams.de> | 2018-12-11 20:58:20 +0100 |
| commit | 66693960f574aa830986e1603657af36423b24eb (patch) | |
| tree | 035aae54d64d79e514f95e18cc3dcf411a98c55e /drivers/usb/core/usb.c | |
| parent | 3ca3f86f7f4856222a8b697d60d32717160a1a1b (diff) | |
| parent | 40e020c129cfc991e8ab4736d2665351ffd1468d (diff) | |
| download | linux-66693960f574aa830986e1603657af36423b24eb.tar.gz linux-66693960f574aa830986e1603657af36423b24eb.tar.bz2 linux-66693960f574aa830986e1603657af36423b24eb.zip | |
Merge tag 'v4.20-rc6' into i2c/for-5.0
Linux 4.20-rc6
Diffstat (limited to 'drivers/usb/core/usb.c')
| -rw-r--r-- | drivers/usb/core/usb.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c index 79d8bd7a612e..4ebfbd737905 100644 --- a/drivers/usb/core/usb.c +++ b/drivers/usb/core/usb.c @@ -832,14 +832,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_number); */ int __usb_get_extra_descriptor(char *buffer, unsigned size, - unsigned char type, void **ptr) + unsigned char type, void **ptr, size_t minsize) { struct usb_descriptor_header *header; while (size >= sizeof(struct usb_descriptor_header)) { header = (struct usb_descriptor_header *)buffer; - if (header->bLength < 2) { + if (header->bLength < 2 || header->bLength > size) { printk(KERN_ERR "%s: bogus descriptor, type %d length %d\n", usbcore_name, @@ -848,7 +848,7 @@ int __usb_get_extra_descriptor(char *buffer, unsigned size, return -1; } - if (header->bDescriptorType == type) { + if (header->bDescriptorType == type && header->bLength >= minsize) { *ptr = header; return 0; } |