On Tue, May 26, 2015 at 02:17:49PM +0200, Jason A. Donenfeld wrote: > diff --git a/drivers/staging/ozwpan/ozusbsvc1.c > b/drivers/staging/ozwpan/ozusbsvc1.c > index 8552053..1bde6aa 100644 > --- a/drivers/staging/ozwpan/ozusbsvc1.c > +++ b/drivers/staging/ozwpan/ozusbsvc1.c > @@ -326,11 +326,13 @@ static void oz_usb_handle_ep_data(struct oz_usb_ctx > *usb_ctx, > struct oz_multiple_fixed *body = > (struct oz_multiple_fixed *)data_hdr; > u8 *data = body->data; > - int n; > + unsigned int n; > if (!body->unit_size) > break; > n = (len - sizeof(struct oz_multiple_fixed)+1) > / body->unit_size; > + if (n > len / body->unit_size) > + break;
You sure do like wrapping to a high value and testing the result for wrapping instead of validating before doing the subtraction... regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
