hc
2024-05-10 23fa18eaa71266feff7ba8d83022d9e1cc83c65a
kernel/drivers/net/usb/sr9700.c
....@@ -410,7 +410,7 @@
410410 /* ignore the CRC length */
411411 len = (skb->data[1] | (skb->data[2] << 8)) - 4;
412412
413
- if (len > ETH_FRAME_LEN || len > skb->len)
413
+ if (len > ETH_FRAME_LEN || len > skb->len || len < 0)
414414 return 0;
415415
416416 /* the last packet of current skb */
....@@ -434,7 +434,7 @@
434434 usbnet_skb_return(dev, sr_skb);
435435
436436 skb_pull(skb, len + SR_RX_OVERHEAD);
437
- };
437
+ }
438438
439439 return 0;
440440 }