On Tue, May 26, 2015 at 02:17:49PM +0200, Jason A. Donenfeld wrote: > diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c > index 8552053..1bde6aa 100644 > --- a/drivers/staging/ozwpan/ozusbsvc1.c > +++ b/drivers/staging/ozwpan/ozusbsvc1.c > @@ -326,11 +326,13 @@ static void oz_usb_handle_ep_data(struct oz_usb_ctx *usb_ctx, > struct oz_multiple_fixed *body = > (struct oz_multiple_fixed *)data_hdr; > u8 *data = body->data; > - int n; > + unsigned int n; > if (!body->unit_size) > break; > n = (len - sizeof(struct oz_multiple_fixed)+1) > / body->unit_size; > + if (n > len / body->unit_size) > + break; You sure do like wrapping to a high value and testing the result for wrapping instead of validating before doing the subtraction... regards, dan carpenter _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
