aboutsummaryrefslogtreecommitdiff
path: root/drivers/net/ps3_gelic_wireless.c
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2008-04-17 23:56:30 -0700
committerDavid S. Miller <davem@davemloft.net>2008-04-17 23:56:30 -0700
commit1e42198609d73ed1a9adcba2af275c24c2678420 (patch)
tree32fd4d9073bfc0f3909af8f9fb4bcff38951d01a /drivers/net/ps3_gelic_wireless.c
parent794eb6bf20ebf992c040ea831cd3a9c64b0c1f7a (diff)
parent4b119e21d0c66c22e8ca03df05d9de623d0eb50f (diff)
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6
Diffstat (limited to 'drivers/net/ps3_gelic_wireless.c')
-rw-r--r--drivers/net/ps3_gelic_wireless.c11
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/net/ps3_gelic_wireless.c b/drivers/net/ps3_gelic_wireless.c
index f9719cfa046..0d32123085e 100644
--- a/drivers/net/ps3_gelic_wireless.c
+++ b/drivers/net/ps3_gelic_wireless.c
@@ -512,13 +512,18 @@ static void gelic_wl_parse_ie(u8 *data, size_t len,
data, len);
memset(ie_info, 0, sizeof(struct ie_info));
- while (0 < data_left) {
+ while (2 <= data_left) {
item_id = *pos++;
item_len = *pos++;
+ data_left -= 2;
+
+ if (data_left < item_len)
+ break;
switch (item_id) {
case MFIE_TYPE_GENERIC:
- if (!memcmp(pos, wpa_oui, OUI_LEN) &&
+ if ((OUI_LEN + 1 <= item_len) &&
+ !memcmp(pos, wpa_oui, OUI_LEN) &&
pos[OUI_LEN] == 0x01) {
ie_info->wpa.data = pos - 2;
ie_info->wpa.len = item_len + 2;
@@ -535,7 +540,7 @@ static void gelic_wl_parse_ie(u8 *data, size_t len,
break;
}
pos += item_len;
- data_left -= item_len + 2;
+ data_left -= item_len;
}
pr_debug("%s: wpa=%p,%d wpa2=%p,%d\n", __func__,
ie_info->wpa.data, ie_info->wpa.len,