iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6

Browse Source 
* 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
  n_gsm: gsm_data_alloc buffer allocation could fail and it is not being checked
  n_gsm: Fix message length handling when building header
This commit is contained in:
Linus Torvalds 2010-12-20 21:34:16 -08:00
commit e5fcdb7ed8
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/tty/n_gsm.c
View File

@ -716,8 +716,8 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg)
if (msg->len < 128) if (msg->len < 128)
*--dp = (msg->len << 1) | EA; *--dp = (msg->len << 1) | EA;
else { else {
*--dp = ((msg->len & 127) << 1) | EA; *--dp = (msg->len >> 7); /* bits 7 - 15 */
*--dp = (msg->len >> 6) & 0xfe; *--dp = (msg->len & 127) << 1; /* bits 0 - 6 */
} }
} }
@ -968,6 +968,8 @@ static void gsm_control_reply(struct gsm_mux *gsm, int cmd, u8 *data,
{ {
struct gsm_msg *msg; struct gsm_msg *msg;
msg = gsm_data_alloc(gsm, 0, dlen + 2, gsm->ftype); msg = gsm_data_alloc(gsm, 0, dlen + 2, gsm->ftype);
if (msg == NULL)
return;
msg->data[0] = (cmd & 0xFE) << 1 | EA; /* Clear C/R */ msg->data[0] = (cmd & 0xFE) << 1 | EA; /* Clear C/R */
msg->data[1] = (dlen << 1) | EA; msg->data[1] = (dlen << 1) | EA;
memcpy(msg->data + 2, data, dlen); memcpy(msg->data + 2, data, dlen);