hc
2024-02-20 102a0743326a03cd1a1202ceda21e175b7d3575c
kernel/drivers/net/usb/rndis_host.c
....@@ -1,19 +1,7 @@
1
+// SPDX-License-Identifier: GPL-2.0-or-later
12 /*
23 * Host Side support for RNDIS Networking Links
34 * Copyright (C) 2005 by David Brownell
4
- *
5
- * This program is free software; you can redistribute it and/or modify
6
- * it under the terms of the GNU General Public License as published by
7
- * the Free Software Foundation; either version 2 of the License, or
8
- * (at your option) any later version.
9
- *
10
- * This program is distributed in the hope that it will be useful,
11
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
12
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
- * GNU General Public License for more details.
14
- *
15
- * You should have received a copy of the GNU General Public License
16
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
175 */
186 #include <linux/module.h>
197 #include <linux/netdevice.h>
....@@ -267,7 +255,8 @@
267255
268256 off = le32_to_cpu(u.get_c->offset);
269257 len = le32_to_cpu(u.get_c->len);
270
- if (unlikely((8 + off + len) > CONTROL_BUFFER_SIZE))
258
+ if (unlikely((off > CONTROL_BUFFER_SIZE - 8) ||
259
+ (len > CONTROL_BUFFER_SIZE - 8 - off)))
271260 goto response_error;
272261
273262 if (*reply_len != -1 && len != *reply_len)