Dan Carpenter e9a4aa3ba3 NFC: llcp: integer underflow in nfc_llcp_set_remote_gb()
If gb_len is less than 3 it would cause an integer underflow and
possibly memory corruption in nfc_llcp_parse_gb_tlv().

I removed the old test for gb_len == 0.  I also removed the test for
->remote_gb == NULL.  It's not possible for ->remote_gb to be NULL and
we have already dereferenced ->remote_gb_len so it's too late to test.

The old test return -ENODEV but my test returns -EINVAL.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-02-08 14:51:31 -05:00
..
2012-11-30 10:50:22 +01:00
2012-07-19 10:48:00 -07:00
2012-12-11 14:08:47 -08:00
2012-06-15 15:30:15 -07:00
2012-05-17 18:45:20 -04:00
2013-02-04 18:57:47 +01:00
2013-02-04 18:57:46 +01:00
2012-09-26 21:10:25 -04:00