Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1f9e9ce1 authored by Roel Kluin's avatar Roel Kluin Committed by Greg Kroah-Hartman
Browse files

Staging: wlan-ng: skb_p80211_to_ether() - payload_length is unsigned, check before subtraction 



payload_length is unsigned, check before subtraction

Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
parent a1da9da9

drivers/staging/wlan-ng/p80211conv.c

+2 −2
Original line number Diff line number Diff line
@@ -328,11 +328,11 @@ int skb_p80211_to_ether( wlandevice_t *wlandev, u32 ethconv, struct sk_buff *skb 
		memcpy(saddr, w_hdr->a3.a2, WLAN_ETHADDR_LEN);

	} else {

		payload_offset = WLAN_HDR_A4_LEN;

		payload_length -= ( WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN );

		if (payload_length < 0 ) {

		if (payload_length < WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN) {

			WLAN_LOG_ERROR("A4 frame too short!\n");

			return 1;

		}

		payload_length -= (WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN);

		memcpy(daddr, w_hdr->a4.a3, WLAN_ETHADDR_LEN);

		memcpy(saddr, w_hdr->a4.a4, WLAN_ETHADDR_LEN);

	}