Commit 3b06dbbe authored by Roel Kluin's avatar Roel Kluin Committed by Samuel Ortiz

irda: Test index before read in stir421x_patch_device()

Test whether index exceeds fw->size before reading the element
Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarSamuel Ortiz <samuel@sortiz.org>
parent f8cba16c
......@@ -1124,11 +1124,11 @@ static int stir421x_patch_device(struct irda_usb_cb *self)
* The actual image starts after the "STMP" keyword
* so forward to the firmware header tag
*/
for (i = 0; (fw->data[i] != STIR421X_PATCH_END_OF_HDR_TAG) &&
(i < fw->size); i++) ;
for (i = 0; i < fw->size && fw->data[i] !=
STIR421X_PATCH_END_OF_HDR_TAG; i++) ;
/* here we check for the out of buffer case */
if ((STIR421X_PATCH_END_OF_HDR_TAG == fw->data[i]) &&
(i < STIR421X_PATCH_CODE_OFFSET)) {
if (i < STIR421X_PATCH_CODE_OFFSET && i < fw->size &&
STIR421X_PATCH_END_OF_HDR_TAG == fw->data[i]) {
if (!memcmp(fw->data + i + 1, STIR421X_PATCH_STMP_TAG,
sizeof(STIR421X_PATCH_STMP_TAG) - 1)) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment