lkml.org 
[lkml]   [2008]   [Dec]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] wlan: skb_p80211_to_ether() - payload_length is unsigned, check before subtraction
payload_length is unsigned, check before subtraction

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
diff --git a/drivers/staging/wlan-ng/p80211conv.c b/drivers/staging/wlan-ng/p80211conv.c
index 68121b9..9dd8b77 100644
--- a/drivers/staging/wlan-ng/p80211conv.c
+++ b/drivers/staging/wlan-ng/p80211conv.c
@@ -333,11 +333,11 @@ int skb_p80211_to_ether( wlandevice_t *wlandev, UINT32 ethconv, struct sk_buff *
memcpy(saddr, w_hdr->a3.a2, WLAN_ETHADDR_LEN);
} else {
payload_offset = WLAN_HDR_A4_LEN;
- payload_length -= ( WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN );
- if (payload_length < 0 ) {
+ if (payload_length < WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN) {
WLAN_LOG_ERROR("A4 frame too short!\n");
return 1;
}
+ payload_length -= (WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN);
memcpy(daddr, w_hdr->a4.a3, WLAN_ETHADDR_LEN);
memcpy(saddr, w_hdr->a4.a4, WLAN_ETHADDR_LEN);
}


\
 
 \ /
  Last update: 2008-12-03 00:09    [W:0.022 / U:0.312 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site