diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-05-08 04:21:35 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-05-08 04:21:35 +0000 |
| commit | 7b642cd94bb96385cbdbb36a1952f129af6b1bbb (patch) | |
| tree | e7c4209372da8a2fa745aaa3e99d062e54d0f556 /drivers/net/wireless/marvell/mwifiex/util.c | |
| parent | Adding debian version 4.19.289-2. (diff) | |
| download | linux-7b642cd94bb96385cbdbb36a1952f129af6b1bbb.tar.xz linux-7b642cd94bb96385cbdbb36a1952f129af6b1bbb.zip | |
Merging upstream version 4.19.304.
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'drivers/net/wireless/marvell/mwifiex/util.c')
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/util.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c index f9b71539d..c45f72779 100644 --- a/drivers/net/wireless/marvell/mwifiex/util.c +++ b/drivers/net/wireless/marvell/mwifiex/util.c @@ -405,11 +405,15 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv, } rx_pd = (struct rxpd *)skb->data; + pkt_len = le16_to_cpu(rx_pd->rx_pkt_length); + if (pkt_len < sizeof(struct ieee80211_hdr) + sizeof(pkt_len)) { + mwifiex_dbg(priv->adapter, ERROR, "invalid rx_pkt_length"); + return -1; + } skb_pull(skb, le16_to_cpu(rx_pd->rx_pkt_offset)); skb_pull(skb, sizeof(pkt_len)); - - pkt_len = le16_to_cpu(rx_pd->rx_pkt_length); + pkt_len -= sizeof(pkt_len); ieee_hdr = (void *)skb->data; if (ieee80211_is_mgmt(ieee_hdr->frame_control)) { @@ -422,7 +426,7 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv, skb->data + sizeof(struct ieee80211_hdr), pkt_len - sizeof(struct ieee80211_hdr)); - pkt_len -= ETH_ALEN + sizeof(pkt_len); + pkt_len -= ETH_ALEN; rx_pd->rx_pkt_length = cpu_to_le16(pkt_len); cfg80211_rx_mgmt(&priv->wdev, priv->roc_cfg.chan.center_freq, |