Commit 233a26e8 authored by Maximilian Schneider's avatar Maximilian Schneider Committed by Marc Kleine-Budde

net: can: esd_usb2: check index of array before accessing

The esd_usb2_read_bulk_callback() function is parsing the data that comes from
the USB CAN adapter. One datum is used as an index to access the dev->nets[]
array. This patch adds the missing bounds checking.
Acked-by: default avatarMatthias Fuchs <matthias.fuchs@esd.eu>
Signed-off-by: default avatarMaximilian Schneider <max@schneidersoft.net>
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
parent ecb2cf1a
...@@ -412,10 +412,20 @@ static void esd_usb2_read_bulk_callback(struct urb *urb) ...@@ -412,10 +412,20 @@ static void esd_usb2_read_bulk_callback(struct urb *urb)
switch (msg->msg.hdr.cmd) { switch (msg->msg.hdr.cmd) {
case CMD_CAN_RX: case CMD_CAN_RX:
if (msg->msg.rx.net >= dev->net_count) {
dev_err(dev->udev->dev.parent, "format error\n");
break;
}
esd_usb2_rx_can_msg(dev->nets[msg->msg.rx.net], msg); esd_usb2_rx_can_msg(dev->nets[msg->msg.rx.net], msg);
break; break;
case CMD_CAN_TX: case CMD_CAN_TX:
if (msg->msg.txdone.net >= dev->net_count) {
dev_err(dev->udev->dev.parent, "format error\n");
break;
}
esd_usb2_tx_done_msg(dev->nets[msg->msg.txdone.net], esd_usb2_tx_done_msg(dev->nets[msg->msg.txdone.net],
msg); msg);
break; break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment