提交 9279095a 编写于 作者: D David Vrabel 提交者: Greg Kroah-Hartman

USB: wusb: correctly check size of security descriptor.

Reported-by: NRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: NDavid Vrabel <david.vrabel@csr.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
上级 2e9729d0
...@@ -205,15 +205,15 @@ int wusb_dev_sec_add(struct wusbhc *wusbhc, ...@@ -205,15 +205,15 @@ int wusb_dev_sec_add(struct wusbhc *wusbhc,
const void *itr, *top; const void *itr, *top;
char buf[64]; char buf[64];
secd = kmalloc(sizeof(struct usb_security_descriptor), GFP_KERNEL); secd = kmalloc(sizeof(*secd), GFP_KERNEL);
if (secd == NULL) { if (secd == NULL) {
result = -ENOMEM; result = -ENOMEM;
goto out; goto out;
} }
result = usb_get_descriptor(usb_dev, USB_DT_SECURITY, result = usb_get_descriptor(usb_dev, USB_DT_SECURITY,
0, secd, sizeof(struct usb_security_descriptor)); 0, secd, sizeof(*secd));
if (result < sizeof(secd)) { if (result < sizeof(*secd)) {
dev_err(dev, "Can't read security descriptor or " dev_err(dev, "Can't read security descriptor or "
"not enough data: %d\n", result); "not enough data: %d\n", result);
goto out; goto out;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册