Re: [PATCH 1/2] usb: gadget: function: rndis: add length check to response query

[Oliver Neukum]

Hi,

On 08.07.26 13:08, Griffin Kroah-Hartman wrote:
  
> @@ -598,6 +599,13 @@ static int rndis_query_response(struct rndis_params *params,
>   	if (!params->dev)
>   		return -ENOTSUPP;
>   
> +	BufLength = le32_to_cpu(buf->InformationBufferLength);
> +	BufOffset = le32_to_cpu(buf->InformationBufferOffset);
> +	if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||
> +	    (BufOffset > RNDIS_MAX_TOTAL_SIZE) ||
> +	    (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))

Wouldn't those last two lines be more efficiently done with:

BufOffset >= RNDIS_MAX_TOTAL_SIZE - 8

	Regards
		Oliver