.. | .. |
---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-or-later |
---|
1 | 2 | /* |
---|
2 | 3 | * Host Side support for RNDIS Networking Links |
---|
3 | 4 | * Copyright (C) 2005 by David Brownell |
---|
4 | | - * |
---|
5 | | - * This program is free software; you can redistribute it and/or modify |
---|
6 | | - * it under the terms of the GNU General Public License as published by |
---|
7 | | - * the Free Software Foundation; either version 2 of the License, or |
---|
8 | | - * (at your option) any later version. |
---|
9 | | - * |
---|
10 | | - * This program is distributed in the hope that it will be useful, |
---|
11 | | - * but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
12 | | - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
---|
13 | | - * GNU General Public License for more details. |
---|
14 | | - * |
---|
15 | | - * You should have received a copy of the GNU General Public License |
---|
16 | | - * along with this program; if not, see <http://www.gnu.org/licenses/>. |
---|
17 | 5 | */ |
---|
18 | 6 | #include <linux/module.h> |
---|
19 | 7 | #include <linux/netdevice.h> |
---|
.. | .. |
---|
267 | 255 | |
---|
268 | 256 | off = le32_to_cpu(u.get_c->offset); |
---|
269 | 257 | len = le32_to_cpu(u.get_c->len); |
---|
270 | | - if (unlikely((8 + off + len) > CONTROL_BUFFER_SIZE)) |
---|
| 258 | + if (unlikely((off > CONTROL_BUFFER_SIZE - 8) || |
---|
| 259 | + (len > CONTROL_BUFFER_SIZE - 8 - off))) |
---|
271 | 260 | goto response_error; |
---|
272 | 261 | |
---|
273 | 262 | if (*reply_len != -1 && len != *reply_len) |
---|