projects
/
platform
/
kernel
/
linux-arm64.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
a1da9da
)
Staging: wlan-ng: skb_p80211_to_ether() - payload_length is unsigned, check before...
author
Roel Kluin
<roel.kluin@gmail.com>
Tue, 2 Dec 2008 23:06:39 +0000
(
00:06
+0100)
committer
Greg Kroah-Hartman
<gregkh@suse.de>
Tue, 6 Jan 2009 21:52:01 +0000
(13:52 -0800)
payload_length is unsigned, check before subtraction
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
drivers/staging/wlan-ng/p80211conv.c
patch
|
blob
|
history
diff --git
a/drivers/staging/wlan-ng/p80211conv.c
b/drivers/staging/wlan-ng/p80211conv.c
index
993e8f4
..
dfc7b3a
100644
(file)
--- a/
drivers/staging/wlan-ng/p80211conv.c
+++ b/
drivers/staging/wlan-ng/p80211conv.c
@@
-328,11
+328,11
@@
int skb_p80211_to_ether( wlandevice_t *wlandev, u32 ethconv, struct sk_buff *skb
memcpy(saddr, w_hdr->a3.a2, WLAN_ETHADDR_LEN);
} else {
payload_offset = WLAN_HDR_A4_LEN;
- payload_length -= ( WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN );
- if (payload_length < 0 ) {
+ if (payload_length < WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN) {
WLAN_LOG_ERROR("A4 frame too short!\n");
return 1;
}
+ payload_length -= (WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN);
memcpy(daddr, w_hdr->a4.a3, WLAN_ETHADDR_LEN);
memcpy(saddr, w_hdr->a4.a4, WLAN_ETHADDR_LEN);
}