From c716e0116cb800911390a2f79d20743e5ba8e516 Mon Sep 17 00:00:00 2001 From: Andrei Emeltchenko Date: Fri, 30 Dec 2011 12:07:47 +0200 Subject: [PATCH] --- yaml --- r: 284321 b: refs/heads/master c: c5993de864d96b3656e9fca38c377b130105d97a h: refs/heads/master i: 284319: 7d7bcc5b303fd122ecfd17a473cbabbc3caf172a v: v3 --- [refs] | 2 +- trunk/net/bluetooth/hci_event.c | 9 ++++----- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/[refs] b/[refs] index 672c9cfcefee..bccede42cbc6 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 3542b854bc26e5f8e42e0eab4d7f7453b74a362d +refs/heads/master: c5993de864d96b3656e9fca38c377b130105d97a diff --git a/trunk/net/bluetooth/hci_event.c b/trunk/net/bluetooth/hci_event.c index 08c0b4295ecc..d37f5b2a3e3c 100644 --- a/trunk/net/bluetooth/hci_event.c +++ b/trunk/net/bluetooth/hci_event.c @@ -2271,20 +2271,19 @@ static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *s struct hci_ev_num_comp_pkts *ev = (void *) skb->data; int i; - skb_pull(skb, sizeof(*ev)); - - BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl); - if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) { BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode); return; } - if (skb->len < ev->num_hndl * 4) { + if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) + + ev->num_hndl * sizeof(struct hci_comp_pkts_info)) { BT_DBG("%s bad parameters", hdev->name); return; } + BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl); + for (i = 0; i < ev->num_hndl; i++) { struct hci_comp_pkts_info *info = &ev->handles[i]; struct hci_conn *conn;