Skip to contentSkip to conversation

p54: potential signedness issue in p54_parse_rssical()

PATCH In review Dan Carpenter 2 participants 2 messages Dec 2, 2012

Subsystems (4)
Networking Network drivers Kernel janitors Networking drivers (wireless)
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 p54: potential signedness issue in p54_parse_rssical()

"entries" is unsigned here, so it is never less than zero. In theory, len could be less than offset so I have added a check for that.

Signed-off-by Dan Carpenter <[email protected]>
drivers/net/wireless/p54/eeprom.c +3 -2
index 1ef1bfe..d43e374 100644
@@ -541,8 +541,9 @@ static int p54_parse_rssical(struct ieee80211_hw *dev,
 		entries = (len - offset) /
 			sizeof(struct pda_rssi_cal_ext_entry);
 
-		if ((len - offset) % sizeof(struct pda_rssi_cal_ext_entry) ||
-		    entries <= 0) {
+		if (len < offset ||
+		    (len - offset) % sizeof(struct pda_rssi_cal_ext_entry) ||
+		    entries = 0) {
 			wiphy_err(dev->wiphy, "invalid rssi database.\n");
 			goto err_data;
 		}
Acked-by on v1 1/1
#1 lore raw
Quoted 4 lines · On Sunday 02 December 2012 11:36:09 Dan Carpenter wrote:

"entries" is unsigned here, so it is never less than zero. In theory, len could be less than offset so I have added a check for that.

Signed-off-by Dan Carpenter <[email protected]>
Acked-by Christian Lamparter <[email protected]>
Quoted 17 lines
drivers/net/wireless/p54/eeprom.c +3 -2
index 1ef1bfe..d43e374 100644
@@ -541,8 +541,9 @@ static int p54_parse_rssical(struct ieee80211_hw *dev,
 		entries = (len - offset) /
 			sizeof(struct pda_rssi_cal_ext_entry);
 
-		if ((len - offset) % sizeof(struct pda_rssi_cal_ext_entry) ||
-		    entries <= 0) {
+		if (len < offset ||
+		    (len - offset) % sizeof(struct pda_rssi_cal_ext_entry) ||
+		    entries = 0) {
 			wiphy_err(dev->wiphy, "invalid rssi database.\n");
 			goto err_data;
 		}