From roel.kluin@gmail.com Thu Dec 4 11:50:14 2008 From: Roel Kluin Date: Wed, 03 Dec 2008 00:06:39 +0100 Subject: Staging: wlan-ng: skb_p80211_to_ether() - payload_length is unsigned, check before subtraction To: Greg KH Message-ID: <4935BF7F.4080109@gmail.com> payload_length is unsigned, check before subtraction Signed-off-by: Roel Kluin --- drivers/staging/wlan-ng/p80211conv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/staging/wlan-ng/p80211conv.c +++ b/drivers/staging/wlan-ng/p80211conv.c @@ -328,11 +328,11 @@ int skb_p80211_to_ether( wlandevice_t *w memcpy(saddr, w_hdr->a3.a2, WLAN_ETHADDR_LEN); } else { payload_offset = WLAN_HDR_A4_LEN; - payload_length -= ( WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN ); - if (payload_length < 0 ) { + if (payload_length < WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN) { WLAN_LOG_ERROR("A4 frame too short!\n"); return 1; } + payload_length -= (WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN); memcpy(daddr, w_hdr->a4.a3, WLAN_ETHADDR_LEN); memcpy(saddr, w_hdr->a4.a4, WLAN_ETHADDR_LEN); }