--- net/irda/irnet/irnet_ppp.c

+++ net/irda/irnet/irnet_ppp.c

@@ -106,6 +106,9 @@ irnet_ctrl_write(irnet_socket * ap,

while(isspace(start[length - 1]))

length--;

+ DABORT(length < 5 || length > NICKNAME_MAX_LEN + 5,

+ -EINVAL, CTRL_ERROR, "Invalid nickname.\n");

+

/* Copy the name for later reuse */

memcpy(ap->rname, start + 5, length - 5);

ap->rname[length - 5] = '\0';