From 73ea534e2a02dc41efd752665d70cc9f49ed8347 Mon Sep 17 00:00:00 2001
From: Dan Rosenberg <drosenberg@vsecurity.com>
Date: Sun, 20 Mar 2011 15:32:06 +0000
Subject: [PATCH] --- yaml --- r: 243235 b: refs/heads/master c:
 d370af0ef7951188daeb15bae75db7ba57c67846 h: refs/heads/master i:   243233:
 9583312b0b3ba9ec99dfde2559e1a7e2e013ba36   243231:
 37f9550e1aa8285951d43f91b31a9762043fd00c v: v3

---
 [refs]                 | 2 +-
 trunk/net/irda/iriap.c | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 397dd7fcebe5..dc0d7a04cedc 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: d50e7e3604778bfc2dc40f440e0742dbae399d54
+refs/heads/master: d370af0ef7951188daeb15bae75db7ba57c67846
diff --git a/trunk/net/irda/iriap.c b/trunk/net/irda/iriap.c
index 5b743bdd89ba..36477538cea8 100644
--- a/trunk/net/irda/iriap.c
+++ b/trunk/net/irda/iriap.c
@@ -656,10 +656,16 @@ static void iriap_getvaluebyclass_indication(struct iriap_cb *self,
 	n = 1;
 
 	name_len = fp[n++];
+
+	IRDA_ASSERT(name_len < IAS_MAX_CLASSNAME + 1, return;);
+
 	memcpy(name, fp+n, name_len); n+=name_len;
 	name[name_len] = '\0';
 
 	attr_len = fp[n++];
+
+	IRDA_ASSERT(attr_len < IAS_MAX_ATTRIBNAME + 1, return;);
+
 	memcpy(attr, fp+n, attr_len); n+=attr_len;
 	attr[attr_len] = '\0';