On 19.07.2015 12:52, Dan Carpenter wrote:
> The pointer math here was totally wrong so we were reading nonsense
> information from beyond the end of the buffer. It could lead to an oops
> if that memory wasn't mapped.
>
> The "pReasonCode" pointer is assigned but never used so I deleted it.
>
> With-Fix-From: Mateusz Kulikowski <mateusz.kulikowski@xxxxxxxxx>
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> ---
> v2: Mateusz noticed some more pointer math bugs on the next lines.
>
> diff --git a/drivers/staging/rtl8192e/rtl819x_BAProc.c b/drivers/staging/rtl8192e/rtl819x_BAProc.c
> index 60f536c..78ede4a 100644
> --- a/drivers/staging/rtl8192e/rtl819x_BAProc.c
> +++ b/drivers/staging/rtl8192e/rtl819x_BAProc.c
> @@ -428,7 +428,6 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
> {
> struct rtllib_hdr_3addr *delba = NULL;
> union delba_param_set *pDelBaParamSet = NULL;
> - u16 *pReasonCode = NULL;
> u8 *dst = NULL;
>
> if (skb->len < sizeof(struct rtllib_hdr_3addr) + 6) {
> @@ -453,9 +452,7 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
> #endif
> delba = (struct rtllib_hdr_3addr *)skb->data;
> dst = (u8 *)(&delba->addr2[0]);
> - delba += sizeof(struct rtllib_hdr_3addr);
> - pDelBaParamSet = (union delba_param_set *)(delba+2);
> - pReasonCode = (u16 *)(delba+4);
> + pDelBaParamSet = (union delba_param_set *)&delba->payload[2];
>
> if (pDelBaParamSet->field.Initiator == 1) {
> struct rx_ts_record *pRxTs;
>
Acked/Tested-by me
Thanks,
Mateusz
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
