From 6dac3447425d932fa76a4e69d32eead9dd090b27 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Sun, 2 Dec 2012 13:36:09 +0300 Subject: [PATCH] p54: potential signedness issue in p54_parse_rssical() "entries" is unsigned here, so it is never less than zero. In theory, len could be less than offset so I have added a check for that. Signed-off-by: Dan Carpenter Acked-by: Christian Lamparter Signed-off-by: John W. Linville --- drivers/net/wireless/p54/eeprom.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c index 1ef1bfe6a9d7..d43e3740e45d 100644 --- a/drivers/net/wireless/p54/eeprom.c +++ b/drivers/net/wireless/p54/eeprom.c @@ -541,8 +541,9 @@ static int p54_parse_rssical(struct ieee80211_hw *dev, entries = (len - offset) / sizeof(struct pda_rssi_cal_ext_entry); - if ((len - offset) % sizeof(struct pda_rssi_cal_ext_entry) || - entries <= 0) { + if (len < offset || + (len - offset) % sizeof(struct pda_rssi_cal_ext_entry) || + entries == 0) { wiphy_err(dev->wiphy, "invalid rssi database.\n"); goto err_data; } -- 2.20.1