staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data()

[linux.git] / drivers / staging / rtl8188eu / core / rtw_ap.c

diff --git a/drivers/staging/rtl8188eu/core/rtw_ap.c b/drivers/staging/rtl8188eu/core/rtw_ap.c
index 255c30eb5d07c7ac9cdef035d6c95a6373a54529..519b4d3584a27722db7f5a8f3be1f0bfeccf1fe7 100644 (file)
--- a/drivers/staging/rtl8188eu/core/rtw_ap.c
+++ b/drivers/staging/rtl8188eu/core/rtw_ap.c
@@ -30,7 +30,6 @@ void init_mlme_ap_info(struct adapter *padapter)
        struct sta_priv *pstapriv = &padapter->stapriv;
        struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
 
-
        spin_lock_init(&pmlmepriv->bcn_update_lock);
 
        /* for ACL */
@@ -720,7 +719,7 @@ static void start_bss_network(struct adapter *padapter, u8 *pbuf)
        u8 val8, cur_channel, cur_bwmode, cur_ch_offset;
        u16 bcn_interval;
        u32     acparm;
-       int     ie_len;
+       uint    ie_len;
        struct registry_priv     *pregpriv = &padapter->registrypriv;
        struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
        struct security_priv *psecuritypriv = &padapter->securitypriv;
@@ -879,7 +878,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf,  int len)
                return _FAIL;
 
 
-       if (len > MAX_IE_SZ)
+       if (len < 0 || len > MAX_IE_SZ)
                return _FAIL;
 
        pbss_network->IELength = len;