usbnet: ipheth: fix possible overflow in DPE length check
commit c219427e upstream. Originally, it was possible for the DPE length check to overflow if wDatagramIndex + wDatagramLength > U16_MAX. This could lead to an OoB read. Move the wDatagramIndex term to the other side of the inequality. An existing condition ensures that wDatagramIndex < urb->actual_length. Fixes: a2d274c6 ("usbnet: ipheth: add CDC NCM support") Cc: stable@vger.kernel.org Signed-off-by:Foster Snowhill <forst@pen.gy> Reviewed-by:
Jakub Kicinski <kuba@kernel.org> Signed-off-by:
Paolo Abeni <pabeni@redhat.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Loading
Please sign in to comment