diff options
| author | Mark Brown <broonie@kernel.org> | 2018-01-08 15:54:50 +0000 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2018-01-08 15:54:50 +0000 |
| commit | 498495dba268b20e8eadd7fe93c140c68b6cc9d2 (patch) | |
| tree | 00d1562049d8bc2194fddd9ba0cbbe0812ad6f68 /lib/asn1_decoder.c | |
| parent | d5cc0a1fcbb5ddbef9fdd4c4a978da3254ddbf37 (diff) | |
| parent | 5c256045b87b8aa8e5bc9d2e2fdc0802351c1f99 (diff) | |
| download | linux-498495dba268b20e8eadd7fe93c140c68b6cc9d2.tar.gz linux-498495dba268b20e8eadd7fe93c140c68b6cc9d2.tar.bz2 linux-498495dba268b20e8eadd7fe93c140c68b6cc9d2.zip | |
Merge branch 'fix/intel' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into asoc-intel
Diffstat (limited to 'lib/asn1_decoder.c')
| -rw-r--r-- | lib/asn1_decoder.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c index 0bd8a611eb83..1ef0cec38d78 100644 --- a/lib/asn1_decoder.c +++ b/lib/asn1_decoder.c @@ -228,7 +228,7 @@ next_op: hdr = 2; /* Extract a tag from the data */ - if (unlikely(dp >= datalen - 1)) + if (unlikely(datalen - dp < 2)) goto data_overrun_error; tag = data[dp++]; if (unlikely((tag & 0x1f) == ASN1_LONG_TAG)) @@ -274,7 +274,7 @@ next_op: int n = len - 0x80; if (unlikely(n > 2)) goto length_too_long; - if (unlikely(dp >= datalen - n)) + if (unlikely(n > datalen - dp)) goto data_overrun_error; hdr += n; for (len = 0; n > 0; n--) { @@ -284,6 +284,9 @@ next_op: if (unlikely(len > datalen - dp)) goto data_overrun_error; } + } else { + if (unlikely(len > datalen - dp)) + goto data_overrun_error; } if (flags & FLAG_CONS) { |