sllin: Bugfix. Check length in sll_bump.

diff --git a/sllin/sllin.c b/sllin/sllin.c
index b754e93ab021f4812ff950c8947154e71e2c0c9b..0e49aa59250f267ae830ae6a794cdaf1e73b7cef 100644 (file)
--- a/sllin/sllin.c
+++ b/sllin/sllin.c
@@ -260,9 +260,11 @@ static void sllin_send_canfr(struct sllin *sl, canid_t id, char *data, int len)
  */
 static void sll_bump(struct sllin *sl)
 {
+       int len = sl->rx_cnt - SLLIN_BUFF_DATA - 1; /* without checksum */
+       len = (len < 0) ? 0 : len;
+
        sllin_send_canfr(sl, sl->rx_buff[SLLIN_BUFF_ID] & LIN_ID_MASK,
-               sl->rx_buff + SLLIN_BUFF_DATA,
-               sl->rx_cnt - SLLIN_BUFF_DATA - 1); /* without checksum */
+               sl->rx_buff + SLLIN_BUFF_DATA, len);
 }
 
 static void sll_send_rtr(struct sllin *sl)