X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=drivers%2Fparport%2Fprobe.c;h=eef454e99bad25db223a5e11cdcf3ef790367ee1;hb=6a77f38946aaee1cd85eeec6cf4229b204c15071;hp=a360928bae0d969e5fa2579bf1ae8884604d26c6;hpb=87fc8d1bb10cd459024a742c6a10961fefcef18f;p=linux-2.6.git

diff --git a/drivers/parport/probe.c b/drivers/parport/probe.c
index a360928ba..eef454e99 100644
--- a/drivers/parport/probe.c
+++ b/drivers/parport/probe.c
@@ -164,8 +164,16 @@ ssize_t parport_device_id (int devnum, char *buffer, size_t len)
 		if (retval != 2) goto end_id;
 
 		idlen = (length[0] << 8) + length[1] - 2;
-		if (idlen < len)
+		/*
+		 * Check if the caller-allocated buffer is large enough
+		 * otherwise bail out or there will be an at least off by one.
+		 */
+		if (idlen + 1 < len)
 			len = idlen;
+		else {
+			retval = -EINVAL;
+			goto out;
+		}
 		retval = parport_read (dev->port, buffer, len);
 
 		if (retval != len)
@@ -205,12 +213,12 @@ ssize_t parport_device_id (int devnum, char *buffer, size_t len)
 		buffer[len] = '\0';
 		parport_negotiate (dev->port, IEEE1284_MODE_COMPAT);
 	}
-	parport_release (dev);
 
 	if (retval > 2)
 		parse_data (dev->port, dev->daisy, buffer);
 
+out:
+	parport_release (dev);
 	parport_close (dev);
 	return retval;
 }
-EXPORT_SYMBOL(parport_device_id);