git://git.onelab.eu
/
linux-2.6.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
vserver 1.9.5.x5
[linux-2.6.git]
/
drivers
/
parport
/
probe.c
diff --git
a/drivers/parport/probe.c
b/drivers/parport/probe.c
index
a360928
..
eef454e
100644
(file)
--- a/
drivers/parport/probe.c
+++ b/
drivers/parport/probe.c
@@
-164,8
+164,16
@@
ssize_t parport_device_id (int devnum, char *buffer, size_t len)
if (retval != 2) goto end_id;
idlen = (length[0] << 8) + length[1] - 2;
if (retval != 2) goto end_id;
idlen = (length[0] << 8) + length[1] - 2;
- if (idlen < len)
+ /*
+ * Check if the caller-allocated buffer is large enough
+ * otherwise bail out or there will be an at least off by one.
+ */
+ if (idlen + 1 < len)
len = idlen;
len = idlen;
+ else {
+ retval = -EINVAL;
+ goto out;
+ }
retval = parport_read (dev->port, buffer, len);
if (retval != len)
retval = parport_read (dev->port, buffer, len);
if (retval != len)
@@
-205,12
+213,12
@@
ssize_t parport_device_id (int devnum, char *buffer, size_t len)
buffer[len] = '\0';
parport_negotiate (dev->port, IEEE1284_MODE_COMPAT);
}
buffer[len] = '\0';
parport_negotiate (dev->port, IEEE1284_MODE_COMPAT);
}
- parport_release (dev);
if (retval > 2)
parse_data (dev->port, dev->daisy, buffer);
if (retval > 2)
parse_data (dev->port, dev->daisy, buffer);
+out:
+ parport_release (dev);
parport_close (dev);
return retval;
}
parport_close (dev);
return retval;
}
-EXPORT_SYMBOL(parport_device_id);