diff --git a/[refs] b/[refs] index 21814facf9a5..17356a02eab5 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: e658bc556b3b2e699c5d9ba65fcc955f35105f42 +refs/heads/master: b2051f887351864d862160e75bc24362c7af8914 diff --git a/trunk/drivers/ieee1394/csr1212.c b/trunk/drivers/ieee1394/csr1212.c index 889ea0dfe2db..c28f639823d2 100644 --- a/trunk/drivers/ieee1394/csr1212.c +++ b/trunk/drivers/ieee1394/csr1212.c @@ -1234,6 +1234,12 @@ static int csr1212_parse_bus_info_block(struct csr1212_csr *csr) csr->private); if (ret != CSR1212_SUCCESS) return ret; + + /* check ROM header's info_length */ + if (i == 0 && + CSR1212_BE32_TO_CPU(csr->cache_head->data[0]) >> 24 != + bytes_to_quads(csr->bus_info_len) - 1) + return CSR1212_EINVAL; } bi = (struct csr1212_bus_info_block_img*)csr->cache_head->data; @@ -1250,9 +1256,6 @@ static int csr1212_parse_bus_info_block(struct csr1212_csr *csr) return ret; } - if (bytes_to_quads(csr->bus_info_len - sizeof(csr1212_quad_t)) != bi->length) - return CSR1212_EINVAL; - #if 0 /* Apparently there are too many differnt wrong implementations of the * CRC algorithm that verifying them is moot. */