staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data()

[linux.git] / drivers / staging / rtl8188eu / core / rtw_ap.c

diff --git a/drivers/staging/rtl8188eu/core/rtw_ap.c b/drivers/staging/rtl8188eu/core/rtw_ap.c
index 49ab1b4ccbb1a8ad1a240954968c9f1b578e838c..519b4d3584a27722db7f5a8f3be1f0bfeccf1fe7 100644 (file)
--- a/drivers/staging/rtl8188eu/core/rtw_ap.c
+++ b/drivers/staging/rtl8188eu/core/rtw_ap.c
@@ -30,7 +30,6 @@ void init_mlme_ap_info(struct adapter *padapter)
        struct sta_priv *pstapriv = &padapter->stapriv;
        struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
 
-
        spin_lock_init(&pmlmepriv->bcn_update_lock);
 
        /* for ACL */
@@ -720,7 +719,7 @@ static void start_bss_network(struct adapter *padapter, u8 *pbuf)
        u8 val8, cur_channel, cur_bwmode, cur_ch_offset;
        u16 bcn_interval;
        u32     acparm;
-       int     ie_len;
+       uint    ie_len;
        struct registry_priv     *pregpriv = &padapter->registrypriv;
        struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
        struct security_priv *psecuritypriv = &padapter->securitypriv;
@@ -879,7 +878,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf,  int len)
                return _FAIL;
 
 
-       if (len > MAX_IE_SZ)
+       if (len < 0 || len > MAX_IE_SZ)
                return _FAIL;
 
        pbss_network->IELength = len;
@@ -1024,15 +1023,12 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf,  int len)
        p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_CAPABILITY_IE_, &ie_len,
                       (pbss_network->IELength - _BEACON_IE_OFFSET_));
        if (p && ie_len > 0) {
-               u8 rf_type;
                struct ieee80211_ht_cap *pht_cap = (struct ieee80211_ht_cap *)(p + 2);
 
                pHT_caps_ie = p;
                ht_cap = true;
                network_type |= WIRELESS_11_24N;
 
-               rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
-
                if ((psecuritypriv->wpa_pairwise_cipher & WPA_CIPHER_CCMP) ||
                    (psecuritypriv->wpa2_pairwise_cipher & WPA_CIPHER_CCMP))
                        pht_cap->ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY & (0x07 << 2));
@@ -1042,10 +1038,8 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf,  int len)
                /* set  Max Rx AMPDU size  to 64K */
                pht_cap->ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_FACTOR & 0x03);
 
-               if (rf_type == RF_1T1R) {
-                       pht_cap->mcs.rx_mask[0] = 0xff;
-                       pht_cap->mcs.rx_mask[1] = 0x0;
-               }
+               pht_cap->mcs.rx_mask[0] = 0xff;
+               pht_cap->mcs.rx_mask[1] = 0x0;
                memcpy(&pmlmepriv->htpriv.ht_cap, p+2, ie_len);
        }