From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 22 Oct 2013 22:24:42 +0000 (-0700)
Subject: mwifiex: potential integer underflow in mwifiex_ret_wmm_get_status()
X-Git-Tag: v3.13-rc1~33^2~27^2^2~21
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=95edbc30db7882a45c4040747331cf613aa23c4a;p=pandora-kernel.git

mwifiex: potential integer underflow in mwifiex_ret_wmm_get_status()

Before we loop for next iteration we adjust the buffer pointer and
"resp_len":

		curr += (tlv_len + sizeof(tlv_hdr->header));
		resp_len -= (tlv_len + sizeof(tlv_hdr->header));

If "resp_len" gets set to negative then it counts as a high positive
value.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---

Reading git-diff-tree failed