From 9c113a6886db87a09772dddb2dfdfccd372dbecf Mon Sep 17 00:00:00 2001 From: Masakazu Mokuno Date: Mon, 14 Apr 2008 18:07:21 +0900 Subject: [PATCH] --- yaml --- r: 88374 b: refs/heads/master c: b358492cd2a9c67bff352c5a60d86e7fc9627477 h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/drivers/net/ps3_gelic_wireless.c | 11 ++++++++--- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/[refs] b/[refs] index 10ae8f96b9c5..b467118cc6aa 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: dc4ae1f46dbbcd08b3b5e23ad5ef87bf4bb41adf +refs/heads/master: b358492cd2a9c67bff352c5a60d86e7fc9627477 diff --git a/trunk/drivers/net/ps3_gelic_wireless.c b/trunk/drivers/net/ps3_gelic_wireless.c index ddbc6e475e28..c16de5129a71 100644 --- a/trunk/drivers/net/ps3_gelic_wireless.c +++ b/trunk/drivers/net/ps3_gelic_wireless.c @@ -512,13 +512,18 @@ static void gelic_wl_parse_ie(u8 *data, size_t len, data, len); memset(ie_info, 0, sizeof(struct ie_info)); - while (0 < data_left) { + while (2 <= data_left) { item_id = *pos++; item_len = *pos++; + data_left -= 2; + + if (data_left < item_len) + break; switch (item_id) { case MFIE_TYPE_GENERIC: - if (!memcmp(pos, wpa_oui, OUI_LEN) && + if ((OUI_LEN + 1 <= item_len) && + !memcmp(pos, wpa_oui, OUI_LEN) && pos[OUI_LEN] == 0x01) { ie_info->wpa.data = pos - 2; ie_info->wpa.len = item_len + 2; @@ -535,7 +540,7 @@ static void gelic_wl_parse_ie(u8 *data, size_t len, break; } pos += item_len; - data_left -= item_len + 2; + data_left -= item_len; } pr_debug("%s: wpa=%p,%d wpa2=%p,%d\n", __func__, ie_info->wpa.data, ie_info->wpa.len,