Skip to contentSkip to conversation

wlan: skb_p80211_to_ether() - payload_length is unsigned, check before subtraction

PATCH New Roel Kluin 1 participant 1 message Dec 2, 2008 Staging

lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 wlan: skb_p80211_to_ether() - payload_length is unsigned, check before subtraction

payload_length is unsigned, check before subtraction

Signed-off-by Roel Kluin <[email protected]>

---

drivers/staging/wlan-ng/p80211conv.c +2 -2
index 68121b9..9dd8b77 100644
@@ -333,11 +333,11 @@ int skb_p80211_to_ether( wlandevice_t *wlandev, UINT32 ethconv, struct sk_buff *
 		memcpy(saddr, w_hdr->a3.a2, WLAN_ETHADDR_LEN);
 	} else {
 		payload_offset = WLAN_HDR_A4_LEN;
-		payload_length -= ( WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN );
-		if (payload_length < 0 ) {
+		if (payload_length < WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN) {
 			WLAN_LOG_ERROR("A4 frame too short!\n");
 			return 1;
 		}
+		payload_length -= (WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN);
 		memcpy(daddr, w_hdr->a4.a3, WLAN_ETHADDR_LEN);
 		memcpy(saddr, w_hdr->a4.a4, WLAN_ETHADDR_LEN);
 	}