From: Dan Carpenter Date: Thu, 31 Jan 2013 08:16:46 +0000 (+0300) Subject: NFC: llcp: integer underflow in nfc_llcp_set_remote_gb() X-Git-Tag: v3.9-rc1~139^2~31^2^2~77 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e9a4aa3ba386c8a368baaadde6f9e5c3d5f17cfe;p=pandora-kernel.git NFC: llcp: integer underflow in nfc_llcp_set_remote_gb() If gb_len is less than 3 it would cause an integer underflow and possibly memory corruption in nfc_llcp_parse_gb_tlv(). I removed the old test for gb_len == 0. I also removed the test for ->remote_gb == NULL. It's not possible for ->remote_gb to be NULL and we have already dereferenced ->remote_gb_len so it's too late to test. The old test return -ENODEV but my test returns -EINVAL. Signed-off-by: Dan Carpenter Signed-off-by: John W. Linville --- Reading git-diff-tree failed