kernel/drivers/net/usb/sr9700.c
.. .. @@ -410,7 +410,7 @@ 410 410 /* ignore the CRC length */ 411 411 len = (skb->data[1] | (skb->data[2] << 8)) - 4; 412 412 413 - if (len > ETH_FRAME_LEN || len > skb->len)413 + if (len > ETH_FRAME_LEN || len > skb->len || len < 0)414 414 return 0; 415 415 416 416 /* the last packet of current skb */