diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-12-02 13:36:09 +0300 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2012-12-03 13:51:59 -0500 |
| commit | 6dac3447425d932fa76a4e69d32eead9dd090b27 (patch) | |
| tree | 83cb00258be6d34244785d069816e00247ce2839 | |
| parent | 06ef5c4bbb9816e7a7eb44917f11c2e3375fb51a (diff) | |
| download | linux-6dac3447425d932fa76a4e69d32eead9dd090b27.tar.bz2 | |
p54: potential signedness issue in p54_parse_rssical()
"entries" is unsigned here, so it is never less than zero. In theory,
len could be less than offset so I have added a check for that.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/p54/eeprom.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c index 1ef1bfe6a9d7..d43e3740e45d 100644 --- a/drivers/net/wireless/p54/eeprom.c +++ b/drivers/net/wireless/p54/eeprom.c @@ -541,8 +541,9 @@ static int p54_parse_rssical(struct ieee80211_hw *dev, entries = (len - offset) / sizeof(struct pda_rssi_cal_ext_entry); - if ((len - offset) % sizeof(struct pda_rssi_cal_ext_entry) || - entries <= 0) { + if (len < offset || + (len - offset) % sizeof(struct pda_rssi_cal_ext_entry) || + entries == 0) { wiphy_err(dev->wiphy, "invalid rssi database.\n"); goto err_data; } |