Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

p54: potential signedness issue in p54_parse_rssical()

"entries" is unsigned here, so it is never less than zero. In theory,
len could be less than offset so I have added a check for that.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

authored by

Dan Carpenter and committed by
John W. Linville
6dac3447 06ef5c4b

+3 -2
+3 -2
drivers/net/wireless/p54/eeprom.c
··· 541 541 entries = (len - offset) / 542 542 sizeof(struct pda_rssi_cal_ext_entry); 543 543 544 - if ((len - offset) % sizeof(struct pda_rssi_cal_ext_entry) || 545 - entries <= 0) { 544 + if (len < offset || 545 + (len - offset) % sizeof(struct pda_rssi_cal_ext_entry) || 546 + entries == 0) { 546 547 wiphy_err(dev->wiphy, "invalid rssi database.\n"); 547 548 goto err_data; 548 549 }