提交 1f9e9ce1 编写于 作者: R Roel Kluin 提交者: Greg Kroah-Hartman

Staging: wlan-ng: skb_p80211_to_ether() - payload_length is unsigned, check before subtraction

payload_length is unsigned, check before subtraction
Signed-off-by: NRoel Kluin <roel.kluin@gmail.com>
上级 a1da9da9
......@@ -328,11 +328,11 @@ int skb_p80211_to_ether( wlandevice_t *wlandev, u32 ethconv, struct sk_buff *skb
memcpy(saddr, w_hdr->a3.a2, WLAN_ETHADDR_LEN);
} else {
payload_offset = WLAN_HDR_A4_LEN;
payload_length -= ( WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN );
if (payload_length < 0 ) {
if (payload_length < WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN) {
WLAN_LOG_ERROR("A4 frame too short!\n");
return 1;
}
payload_length -= (WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN);
memcpy(daddr, w_hdr->a4.a3, WLAN_ETHADDR_LEN);
memcpy(saddr, w_hdr->a4.a4, WLAN_ETHADDR_LEN);
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册