korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-16 00:34:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

Staging: wlan-ng: skb_p80211_to_ether() - payload_length is unsigned, check before subtraction

Browse Source 
payload_length is unsigned, check before subtraction

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
This commit is contained in:
Roel Kluin 2008-12-03 00:06:39 +01:00 committed by Greg Kroah-Hartman
parent a1da9da991
commit 1f9e9ce1f9
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/staging/wlan-ng/p80211conv.c
View File

@ -328,11 +328,11 @@ int skb_p80211_to_ether( wlandevice_t *wlandev, u32 ethconv, struct sk_buff *skb
memcpy(saddr, w_hdr->a3.a2, WLAN_ETHADDR_LEN); memcpy(saddr, w_hdr->a3.a2, WLAN_ETHADDR_LEN);
} else { } else {
payload_offset = WLAN_HDR_A4_LEN; payload_offset = WLAN_HDR_A4_LEN;
payload_length -= ( WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN ); if (payload_length < WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN) {
if (payload_length < 0 ) {
WLAN_LOG_ERROR("A4 frame too short!\n"); WLAN_LOG_ERROR("A4 frame too short!\n");
return 1; return 1;
} }
payload_length -= (WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN);
memcpy(daddr, w_hdr->a4.a3, WLAN_ETHADDR_LEN); memcpy(daddr, w_hdr->a4.a3, WLAN_ETHADDR_LEN);
memcpy(saddr, w_hdr->a4.a4, WLAN_ETHADDR_LEN); memcpy(saddr, w_hdr->a4.a4, WLAN_ETHADDR_LEN);
} }