diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2008-04-16 07:44:27 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-04-16 07:44:27 -0700 |
| commit | b4b8f57965e007afbbb0175ea28f733723c5260b (patch) | |
| tree | 7f4aeda48ada35771ea3e63bbbb36e52c47aeb62 /drivers/net/ps3_gelic_wireless.c | |
| parent | 424b00e2c0f0c38f2cf5331391742ec998f6d89f (diff) | |
| parent | 56f367bbfd5a7439961499ca6a2f0822d2074d83 (diff) | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
[TCP]: Add return value indication to tcp_prune_ofo_queue().
PS3: gelic: fix the oops on the broken IE returned from the hypervisor
b43legacy: fix DMA mapping leakage
mac80211: remove message on receiving unexpected unencrypted frames
Update rt2x00 MAINTAINERS entry
Add rfkill to MAINTAINERS file
rfkill: Fix device type check when toggling states
b43legacy: Fix usage of struct device used for DMAing
ssb: Fix usage of struct device used for DMAing
MAINTAINERS: move to generic repository for iwlwifi
b43legacy: fix initvals loading on bcm4303
rtl8187: Add missing priv->vif assignments
netconsole: only set CON_PRINTBUFFER if the user specifies a netconsole
[CAN]: Update documentation of struct sockaddr_can
MAINTAINERS: isdn4linux@listserv.isdn4linux.de is subscribers-only
[TCP]: Fix never pruned tcp out-of-order queue.
[NET_SCHED] sch_api: fix qdisc_tree_decrease_qlen() loop
Diffstat (limited to 'drivers/net/ps3_gelic_wireless.c')
| -rw-r--r-- | drivers/net/ps3_gelic_wireless.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/net/ps3_gelic_wireless.c b/drivers/net/ps3_gelic_wireless.c index ddbc6e475e2..c16de5129a7 100644 --- a/drivers/net/ps3_gelic_wireless.c +++ b/drivers/net/ps3_gelic_wireless.c @@ -512,13 +512,18 @@ static void gelic_wl_parse_ie(u8 *data, size_t len, data, len); memset(ie_info, 0, sizeof(struct ie_info)); - while (0 < data_left) { + while (2 <= data_left) { item_id = *pos++; item_len = *pos++; + data_left -= 2; + + if (data_left < item_len) + break; switch (item_id) { case MFIE_TYPE_GENERIC: - if (!memcmp(pos, wpa_oui, OUI_LEN) && + if ((OUI_LEN + 1 <= item_len) && + !memcmp(pos, wpa_oui, OUI_LEN) && pos[OUI_LEN] == 0x01) { ie_info->wpa.data = pos - 2; ie_info->wpa.len = item_len + 2; @@ -535,7 +540,7 @@ static void gelic_wl_parse_ie(u8 *data, size_t len, break; } pos += item_len; - data_left -= item_len + 2; + data_left -= item_len; } pr_debug("%s: wpa=%p,%d wpa2=%p,%d\n", __func__, ie_info->wpa.data, ie_info->wpa.len, |