drivers/net/wireless/hermes.c unsigned int comparision
PATCH 1/1 drivers/net/wireless/hermes.c unsigned int comparision
hermas_bap_pread, hermes_bap_pwrite, and hermes_bap_pwrite_pad all have a parameter "len" that is declared unsigned, but checked for a value less than zero. Auditing the callers, it is possible for len to be passed a negative value, so len should be an int.
Thanks to LinuxICC (http://linuxicc.sf.net)
Signed-off-by Gabriel A. Devenyi <[email protected]>
drivers/net/wireless/hermes.c +3 -3
@@ -398,7 +398,7 @@ static int hermes_bap_seek(hermes_t *hw,* * Returns: < 0 on internal failure (errno), 0 on success, > 0 on error from firmware */ -int hermes_bap_pread (hermes_t *hw,int bap,void *buf,unsigned len, +int hermes_bap_pread (hermes_t *hw,int bap,void *buf,int len,u16 id,u16 offset) {int dreg = bap ?HERMES_DATA1 :HERMES_DATA0 ;
@@ -424,7 +424,7 @@ int hermes_bap_pread(hermes_t *hw, int b* * Returns: < 0 on internal failure (errno), 0 on success, > 0 on error from firmware */ -int hermes_bap_pwrite (hermes_t *hw,int bap,const void *buf,unsigned len, +int hermes_bap_pwrite (hermes_t *hw,int bap,const void *buf,int len,u16 id,u16 offset) {int dreg = bap ?HERMES_DATA1 :HERMES_DATA0 ;
@@ -450,7 +450,7 @@ int hermes_bap_pwrite(hermes_t *hw, int* * Returns: < 0 on internal failure (errno), 0 on success, > 0 on error from firmware */ -int hermes_bap_pwrite_pad (hermes_t *hw,int bap,const void *buf,unsigned data_len,unsigned len, +int hermes_bap_pwrite_pad (hermes_t *hw,int bap,const void *buf,unsigned data_len,int len,u16 id,u16 offset) {int dreg = bap ?HERMES_DATA1 :HERMES_DATA0 ;
Signature · 2 lines
Gabriel A. Devenyi [email protected]