summaryrefslogtreecommitdiff
path: root/drivers/net/irda
diff options
context:
space:
mode:
authorRoel Kluin <roel.kluin@gmail.com>2010-10-05 01:30:02 +0200
committerSamuel Ortiz <sameo@linux.intel.com>2010-10-11 02:11:58 +0200
commit3b06dbbeadb6488cd00999b61b080bb6f0218503 (patch)
treef2a7e56464f6e82de25318c934d07bf6246b39cf /drivers/net/irda
parentf8cba16cad68c9b9ee7fecae48a1b91708e8e482 (diff)
irda: Test index before read in stir421x_patch_device()
Test whether index exceeds fw->size before reading the element Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Samuel Ortiz <samuel@sortiz.org>
Diffstat (limited to 'drivers/net/irda')
-rw-r--r--drivers/net/irda/irda-usb.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index cce82f101f50..e4ea61944c22 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1124,11 +1124,11 @@ static int stir421x_patch_device(struct irda_usb_cb *self)
* The actual image starts after the "STMP" keyword
* so forward to the firmware header tag
*/
- for (i = 0; (fw->data[i] != STIR421X_PATCH_END_OF_HDR_TAG) &&
- (i < fw->size); i++) ;
+ for (i = 0; i < fw->size && fw->data[i] !=
+ STIR421X_PATCH_END_OF_HDR_TAG; i++) ;
/* here we check for the out of buffer case */
- if ((STIR421X_PATCH_END_OF_HDR_TAG == fw->data[i]) &&
- (i < STIR421X_PATCH_CODE_OFFSET)) {
+ if (i < STIR421X_PATCH_CODE_OFFSET && i < fw->size &&
+ STIR421X_PATCH_END_OF_HDR_TAG == fw->data[i]) {
if (!memcmp(fw->data + i + 1, STIR421X_PATCH_STMP_TAG,
sizeof(STIR421X_PATCH_STMP_TAG) - 1)) {