USB: cxacru: potential underflow in cxacru_cm_get_array()
authorDan Carpenter <dan.carpenter@oracle.com>
Sun, 19 May 2013 18:52:20 +0000 (21:52 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 7 Jun 2013 19:46:35 +0000 (12:46 -0700)
commit2d722d28a3614fcd7959adc6e7debf9959b4bb8c
treeb415f56fe6b94d80260cec7c6b74642b3a3cf905
parente50d48c8f67b2b96797bc5d66eb3c717d24744ff
USB: cxacru: potential underflow in cxacru_cm_get_array()

commit 2a0ebf80aa95cc758d4725f74a7016e992606a39 upstream.

The value of "offd" comes off the instance->rcv_buf[] and we used it as
the offset into an array.  The problem is that we check the upper bound
but not for negative values.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/atm/cxacru.c