Re: [patch] p54: potential signedness issue in p54_parse_rssical()
From: Christian Lamparter <chunkeey@googlemail.com>
Date: 2012-12-02 13:55:07
Also in:
kernel-janitors, lkml, netdev
On Sunday 02 December 2012 11:36:09 Dan Carpenter wrote:
"entries" is unsigned here, so it is never less than zero. In theory, len could be less than offset so I have added a check for that. Signed-off-by: Dan Carpenter <redacted>
Acked-by: Christian Lamparter <chunkeey@googlemail.com>
quoted hunk ↗ jump to hunk
diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c index 1ef1bfe..d43e374 100644 --- a/drivers/net/wireless/p54/eeprom.c +++ b/drivers/net/wireless/p54/eeprom.c@@ -541,8 +541,9 @@ static int p54_parse_rssical(struct ieee80211_hw *dev, entries = (len - offset) / sizeof(struct pda_rssi_cal_ext_entry); - if ((len - offset) % sizeof(struct pda_rssi_cal_ext_entry) || - entries <= 0) { + if (len < offset || + (len - offset) % sizeof(struct pda_rssi_cal_ext_entry) || + entries == 0) { wiphy_err(dev->wiphy, "invalid rssi database.\n"); goto err_data; }