--- net/irda/iriap.c

+++ net/irda/iriap.c

@@ -501,7 +501,8 @@ static void iriap_getvaluebyclass_confir

IRDA_DEBUG(4, "%s(), strlen=%d\n", __func__, value_len);

/* Make sure the string is null-terminated */

- fp[n+value_len] = 0x00;

+ if (n + value_len < skb->len)

+ fp[n + value_len] = 0x00;

IRDA_DEBUG(4, "Got string %s\n", fp+n);

/* Will truncate to IAS_MAX_STRING bytes */