diff options
| author |   Stephane Grosjean <s.grosjean@peak-system.com> | 2013-08-09 11:44:06 +0200 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2013-08-11 21:51:49 -0700 |
| commit | 3c322a56b01695df15c70bfdc2d02e0ccd80654e (patch) | |
| tree | 3da6918ee3ce3e41f40395214aa15c27f50c176a /drivers/net/can | |
| parent | macvtap: fix two races (diff) | |
| download | linux-dev-3c322a56b01695df15c70bfdc2d02e0ccd80654e.tar.xz linux-dev-3c322a56b01695df15c70bfdc2d02e0ccd80654e.zip | |
can: pcan_usb: fix wrong memcpy() bytes length
Fix possibly wrong memcpy() bytes length since some CAN records received from
PCAN-USB could define a DLC field in range [9..15].
In that case, the real DLC value MUST be used to move forward the record pointer
but, only 8 bytes max. MUST be copied into the data field of the struct
can_frame object of the skb given to the network core.
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/can')
| -rw-r--r-- | drivers/net/can/usb/peak_usb/pcan_usb.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c index 25723d8ee201..925ab8ec9329 100644 --- a/drivers/net/can/usb/peak_usb/pcan_usb.c +++ b/drivers/net/can/usb/peak_usb/pcan_usb.c @@ -649,7 +649,7 @@ static int pcan_usb_decode_data(struct pcan_usb_msg_context *mc, u8 status_len) if ((mc->ptr + rec_len) > mc->end) goto decode_failed; - memcpy(cf->data, mc->ptr, rec_len); + memcpy(cf->data, mc->ptr, cf->can_dlc); mc->ptr += rec_len; } |