sdio: fix read buffer overflow

Avoid buffer underrun when parsing an invalid CISTPL_VERS_1.

Signed-off-by: Roel Kluin <[email protected]>
Cc: David Vrabel <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c
index 963f2937c5e37da83819249826995aa098751f99..6636354b48ceac476c3ecbb7a88054dd4047d8d2 100644 (file)
--- a/drivers/mmc/core/sdio_cis.c
+++ b/drivers/mmc/core/sdio_cis.c
@@ -40,7 +40,7 @@ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func,
                        nr_strings++;
        }
 
-       if (buf[i-1] != '\0') {
+       if (nr_strings < 4) {
                printk(KERN_WARNING "SDIO: ignoring broken CISTPL_VERS_1\n");
                return 0;
        }