diff options
| author | David S. Miller <davem@davemloft.net> | 2008-03-05 12:26:41 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-03-05 12:26:41 -0800 |
| commit | 255333c1db3ec63921de29b134418a4e56e5921e (patch) | |
| tree | b1cd99373cabfa6fed020496d4d74500e7bc7e92 /drivers/net/wireless/p54common.c | |
| parent | 9a43b709a230705ca40a6f854a334a02334a3c1c (diff) | |
| parent | 0d66afe7805b169b6bf3c7a88cf8163298b8ef05 (diff) | |
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
Conflicts:
net/mac80211/rc80211_pid_algo.c
Diffstat (limited to 'drivers/net/wireless/p54common.c')
| -rw-r--r-- | drivers/net/wireless/p54common.c | 20 |
1 files changed, 12 insertions, 8 deletions
diff --git a/drivers/net/wireless/p54common.c b/drivers/net/wireless/p54common.c index 84cc000e71a..63f9badf3f5 100644 --- a/drivers/net/wireless/p54common.c +++ b/drivers/net/wireless/p54common.c @@ -206,18 +206,23 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len) struct p54_common *priv = dev->priv; struct eeprom_pda_wrap *wrap = NULL; struct pda_entry *entry; - int i = 0; unsigned int data_len, entry_len; void *tmp; int err; + u8 *end = (u8 *)eeprom + len; wrap = (struct eeprom_pda_wrap *) eeprom; - entry = (void *)wrap->data + wrap->len; - i += 2; - i += le16_to_cpu(entry->len)*2; - while (i < len) { + entry = (void *)wrap->data + le16_to_cpu(wrap->len); + + /* verify that at least the entry length/code fits */ + while ((u8 *)entry <= end - sizeof(*entry)) { entry_len = le16_to_cpu(entry->len); data_len = ((entry_len - 1) << 1); + + /* abort if entry exceeds whole structure */ + if ((u8 *)entry + sizeof(*entry) + data_len > end) + break; + switch (le16_to_cpu(entry->code)) { case PDR_MAC_ADDRESS: SET_IEEE80211_PERM_ADDR(dev, entry->data); @@ -289,7 +294,8 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len) priv->version = *(u8 *)(entry->data + 1); break; case PDR_END: - i = len; + /* make it overrun */ + entry_len = len; break; default: printk(KERN_INFO "p54: unknown eeprom code : 0x%x\n", @@ -298,8 +304,6 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len) } entry = (void *)entry + (entry_len + 1)*2; - i += 2; - i += entry_len*2; } if (!priv->iq_autocal || !priv->output_limit || !priv->curve_data) { |