From 2da527dcbb166e32eb0364c3e9a21df1f2b1f290 Mon Sep 17 00:00:00 2001
From: Dan Rosenberg <drosenberg@vsecurity.com>
Date: Sat, 19 Mar 2011 20:14:30 +0000
Subject: [PATCH] --- yaml --- r: 243234 b: refs/heads/master c:
 d50e7e3604778bfc2dc40f440e0742dbae399d54 h: refs/heads/master v: v3

---
 [refs]                           | 2 +-
 trunk/net/irda/irnet/irnet_ppp.c | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 23fd593586f2..397dd7fcebe5 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: e433430a0ca9cc1b851a83ac3b305e955b64880a
+refs/heads/master: d50e7e3604778bfc2dc40f440e0742dbae399d54
diff --git a/trunk/net/irda/irnet/irnet_ppp.c b/trunk/net/irda/irnet/irnet_ppp.c
index 7c567b8aa89a..2bb2beb6a373 100644
--- a/trunk/net/irda/irnet/irnet_ppp.c
+++ b/trunk/net/irda/irnet/irnet_ppp.c
@@ -105,6 +105,9 @@ irnet_ctrl_write(irnet_socket *	ap,
 	      while(isspace(start[length - 1]))
 		length--;
 
+	      DABORT(length < 5 || length > NICKNAME_MAX_LEN + 5,
+		     -EINVAL, CTRL_ERROR, "Invalid nickname.\n");
+
 	      /* Copy the name for later reuse */
 	      memcpy(ap->rname, start + 5, length - 5);
 	      ap->rname[length - 5] = '\0';