diff options
| author | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2013-10-08 08:43:00 -0700 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2013-10-08 08:43:00 -0700 |
| commit | e3c55d406bd8df1a878546002c93db90c42be10c (patch) | |
| tree | efb0ba2707c95fd7166cf1b76887c43c977e37dd /drivers/usb/core/config.c | |
| parent | 4d6e482675f13e33599fc3d18fc723959be0a9b6 (diff) | |
| parent | d0e639c9e06d44e713170031fe05fb60ebe680af (diff) | |
Merge tag 'v3.12-rc4' into next
Merge with mainline to bring in changes to input subsystem that were
committed through other trees.
Diffstat (limited to 'drivers/usb/core/config.c')
| -rw-r--r-- | drivers/usb/core/config.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c index 7199adccf444..a6b2cabe7930 100644 --- a/drivers/usb/core/config.c +++ b/drivers/usb/core/config.c @@ -424,7 +424,8 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE); if (config->desc.bDescriptorType != USB_DT_CONFIG || - config->desc.bLength < USB_DT_CONFIG_SIZE) { + config->desc.bLength < USB_DT_CONFIG_SIZE || + config->desc.bLength > size) { dev_err(ddev, "invalid descriptor for config index %d: " "type = 0x%X, length = %d\n", cfgidx, config->desc.bDescriptorType, config->desc.bLength); |