~hc/RK356X_SDK_RELEASE.git

summary
commits
tree
docs
forks
compare

blame | history | patch | commit | commitdiff

2024-02-20 102a0743326a03cd1a1202ceda21e175b7d3575c

 kernel/drivers/net/usb/rndis_host.c
.. .. @@ -255,7 +255,8 @@
255 255  
256 256  	off = le32_to_cpu(u.get_c->offset);
257 257  	len = le32_to_cpu(u.get_c->len);
258 -	if (unlikely((8 + off + len) > CONTROL_BUFFER_SIZE))
258 +	if (unlikely((off > CONTROL_BUFFER_SIZE - 8) ||
259 +		     (len > CONTROL_BUFFER_SIZE - 8 - off)))
259 260  		goto response_error;
260 261  
261 262  	if (*reply_len != -1 && len != *reply_len)

..	..	@@ -255,7 +255,8 @@
255	255
256	256	off = le32_to_cpu(u.get_c->offset);
257	257	len = le32_to_cpu(u.get_c->len);
258		- if (unlikely((8 + off + len) > CONTROL_BUFFER_SIZE))
	258	+ if (unlikely((off > CONTROL_BUFFER_SIZE - 8) \|\|
	259	+ (len > CONTROL_BUFFER_SIZE - 8 - off)))
259	260	goto response_error;
260	261
261	262	if (reply_len != -1 && len != reply_len)