Staging: wlan-ng: skb_p80211_to_ether() - payload_length is unsigned, check before...

payload_length is unsigned, check before subtraction

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>

diff --git a/drivers/staging/wlan-ng/p80211conv.c b/drivers/staging/wlan-ng/p80211conv.c
index 993e8f480736f97e97a0493eec7cbd83c8a7f3d2..dfc7b3a1e9c92b0c40530a6c2b80d93076440e13 100644 (file)
--- a/drivers/staging/wlan-ng/p80211conv.c
+++ b/drivers/staging/wlan-ng/p80211conv.c
@@ -328,11 +328,11 @@ int skb_p80211_to_ether( wlandevice_t *wlandev, u32 ethconv, struct sk_buff *skb
                memcpy(saddr, w_hdr->a3.a2, WLAN_ETHADDR_LEN);
        } else {
                payload_offset = WLAN_HDR_A4_LEN;
-               payload_length -= ( WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN );
-               if (payload_length < 0 ) {
+               if (payload_length < WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN) {
                        WLAN_LOG_ERROR("A4 frame too short!\n");
                        return 1;
                }
+               payload_length -= (WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN);
                memcpy(daddr, w_hdr->a4.a3, WLAN_ETHADDR_LEN);
                memcpy(saddr, w_hdr->a4.a4, WLAN_ETHADDR_LEN);
        }