diff options
| author | Roel Kluin <roel.kluin@gmail.com> | 2008-12-03 00:06:39 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-01-06 13:52:01 -0800 |
| commit | 1f9e9ce1f99e89ee180a3994c44bdff43ebeb139 (patch) | |
| tree | 3cfee53b2f3005facb49ba72d0fdbcdc1bb3aa40 /drivers/staging/wlan-ng/p80211conv.c | |
| parent | a1da9da99152e065912d58950089405b15d0aebd (diff) | |
| download | linux-1f9e9ce1f99e89ee180a3994c44bdff43ebeb139.tar.bz2 | |
Staging: wlan-ng: skb_p80211_to_ether() - payload_length is unsigned, check before subtraction
payload_length is unsigned, check before subtraction
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Diffstat (limited to 'drivers/staging/wlan-ng/p80211conv.c')
| -rw-r--r-- | drivers/staging/wlan-ng/p80211conv.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/staging/wlan-ng/p80211conv.c b/drivers/staging/wlan-ng/p80211conv.c index 993e8f480736..dfc7b3a1e9c9 100644 --- a/drivers/staging/wlan-ng/p80211conv.c +++ b/drivers/staging/wlan-ng/p80211conv.c @@ -328,11 +328,11 @@ int skb_p80211_to_ether( wlandevice_t *wlandev, u32 ethconv, struct sk_buff *skb memcpy(saddr, w_hdr->a3.a2, WLAN_ETHADDR_LEN); } else { payload_offset = WLAN_HDR_A4_LEN; - payload_length -= ( WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN ); - if (payload_length < 0 ) { + if (payload_length < WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN) { WLAN_LOG_ERROR("A4 frame too short!\n"); return 1; } + payload_length -= (WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN); memcpy(daddr, w_hdr->a4.a3, WLAN_ETHADDR_LEN); memcpy(saddr, w_hdr->a4.a4, WLAN_ETHADDR_LEN); } |