Skip to content

Commit

Permalink
p54: potential signedness issue in p54_parse_rssical()
Browse files Browse the repository at this point in the history
"entries" is unsigned here, so it is never less than zero.  In theory,
len could be less than offset so I have added a check for that.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
  • Loading branch information
Dan Carpenter authored and John W. Linville committed Dec 3, 2012
1 parent 06ef5c4 commit 6dac344
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions drivers/net/wireless/p54/eeprom.c
Original file line number Diff line number Diff line change
Expand Up @@ -541,8 +541,9 @@ static int p54_parse_rssical(struct ieee80211_hw *dev,
entries = (len - offset) /
sizeof(struct pda_rssi_cal_ext_entry);

if ((len - offset) % sizeof(struct pda_rssi_cal_ext_entry) ||
entries <= 0) {
if (len < offset ||
(len - offset) % sizeof(struct pda_rssi_cal_ext_entry) ||
entries == 0) {
wiphy_err(dev->wiphy, "invalid rssi database.\n");
goto err_data;
}
Expand Down

0 comments on commit 6dac344

Please sign in to comment.