Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c5b42f34 authored by Gabriel A. Devenyi's avatar Gabriel A. Devenyi Committed by Jeff Garzik
Browse files

[PATCH] drivers/net/wireless/hermes.c unsigned int comparision 

hermas_bap_pread,  hermes_bap_pwrite, and hermes_bap_pwrite_pad all have a parameter "len" that is declared unsigned,
but checked for a value less than zero. Auditing the callers, it is possible for len to be passed a negative value, so len should be an int.

Thanks to LinuxICC (http://linuxicc.sf.net

)

Signed-off-by: default avatarGabriel A. Devenyi <ace@staticwave.ca>
Signed-off-by: default avatarJeff Garzik <jgarzik@pobox.com>
parent cbf7c42b

drivers/net/wireless/hermes.c

+3 −3
Original line number Diff line number Diff line
@@ -398,7 +398,7 @@ static int hermes_bap_seek(hermes_t *hw, int bap, u16 id, u16 offset) 
 *

 * Returns: < 0 on internal failure (errno), 0 on success, > 0 on error from firmware

 */

int hermes_bap_pread(hermes_t *hw, int bap, void *buf, unsigned len,

int hermes_bap_pread(hermes_t *hw, int bap, void *buf, int len,

		     u16 id, u16 offset)

{

	int dreg = bap ? HERMES_DATA1 : HERMES_DATA0;
@@ -424,7 +424,7 @@ int hermes_bap_pread(hermes_t *hw, int bap, void *buf, unsigned len, 
 *

 * Returns: < 0 on internal failure (errno), 0 on success, > 0 on error from firmware

 */

int hermes_bap_pwrite(hermes_t *hw, int bap, const void *buf, unsigned len,

int hermes_bap_pwrite(hermes_t *hw, int bap, const void *buf, int len,

		      u16 id, u16 offset)

{

	int dreg = bap ? HERMES_DATA1 : HERMES_DATA0;
@@ -450,7 +450,7 @@ int hermes_bap_pwrite(hermes_t *hw, int bap, const void *buf, unsigned len, 
 *

 * Returns: < 0 on internal failure (errno), 0 on success, > 0 on error from firmware

 */

int hermes_bap_pwrite_pad(hermes_t *hw, int bap, const void *buf, unsigned data_len, unsigned len,

int hermes_bap_pwrite_pad(hermes_t *hw, int bap, const void *buf, unsigned data_len, int len,

		      u16 id, u16 offset)

{

	int dreg = bap ? HERMES_DATA1 : HERMES_DATA0;