From 354dec671c55a62176c0a798d01ec4cbe37fee28 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Wed, 29 Feb 2012 09:37:53 +0300 Subject: [PATCH] --- yaml --- r: 291136 b: refs/heads/master c: e4e02da2ef01deb36aa80fce6ee0bc3e9725ffe8 h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/drivers/net/wireless/rndis_wlan.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/[refs] b/[refs] index c8d02f0269d6..209d58db63cc 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 551d6fe6cb67ea6f7ca4425a5085b05d34f39730 +refs/heads/master: e4e02da2ef01deb36aa80fce6ee0bc3e9725ffe8 diff --git a/trunk/drivers/net/wireless/rndis_wlan.c b/trunk/drivers/net/wireless/rndis_wlan.c index 454f2f182342..ce138d846193 100644 --- a/trunk/drivers/net/wireless/rndis_wlan.c +++ b/trunk/drivers/net/wireless/rndis_wlan.c @@ -3043,7 +3043,7 @@ static void rndis_wlan_media_specific_indication(struct usbnet *usbdev, struct rndis_indicate *msg, int buflen) { struct ndis_80211_status_indication *indication; - int len, offset; + unsigned int len, offset; offset = offsetof(struct rndis_indicate, status) + le32_to_cpu(msg->offset); @@ -3055,7 +3055,7 @@ static void rndis_wlan_media_specific_indication(struct usbnet *usbdev, return; } - if (offset + len > buflen) { + if (len > buflen || offset > buflen || offset + len > buflen) { netdev_info(usbdev->net, "media specific indication, too large to fit to buffer (%i > %i)\n", offset + len, buflen); return;