staging: rtl: fix possible NULL pointer dereference

[pandora-kernel.git] / drivers / staging / rtl8712 / rtl871x_recv.c

diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c
index 7069f06..3b4a661 100644 (file)
--- a/drivers/staging/rtl8712/rtl871x_recv.c
+++ b/drivers/staging/rtl8712/rtl871x_recv.c
@@ -254,7 +254,7 @@ union recv_frame *r8712_portctrl(struct _adapter *adapter,
        struct sta_info *psta;
        struct  sta_priv *pstapriv;
        union recv_frame *prtnframe;
-       u16 ether_type = 0;
+       u16 ether_type;
 
        pstapriv = &adapter->stapriv;
        ptr = get_recvframe_data(precv_frame);
@@ -263,15 +263,14 @@ union recv_frame *r8712_portctrl(struct _adapter *adapter,
        psta = r8712_get_stainfo(pstapriv, psta_addr);
        auth_alg = adapter->securitypriv.AuthAlgrthm;
        if (auth_alg == 2) {
+               /* get ether_type */
+               ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE;
+               memcpy(&ether_type, ptr, 2);
+               ether_type = ntohs((unsigned short)ether_type);
+
                if ((psta != NULL) && (psta->ieee8021x_blocked)) {
                        /* blocked
                         * only accept EAPOL frame */
-                       prtnframe = precv_frame;
-                       /*get ether_type */
-                       ptr = ptr + pfhdr->attrib.hdrlen +
-                             pfhdr->attrib.iv_len + LLC_HEADER_SIZE;
-                       memcpy(&ether_type, ptr, 2);
-                       ether_type = ntohs((unsigned short)ether_type);
                        if (ether_type == 0x888e)
                                prtnframe = precv_frame;
                        else {
@@ -642,11 +641,16 @@ sint r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe)
                /* append rx status for mp test packets */
                ptr = recvframe_pull(precvframe, (rmv_len -
                      sizeof(struct ethhdr) + 2) - 24);
+               if (!ptr)
+                       return _FAIL;
                memcpy(ptr, get_rxmem(precvframe), 24);
                ptr += 24;
-       } else
+       } else {
                ptr = recvframe_pull(precvframe, (rmv_len -
                      sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
+               if (!ptr)
+                       return _FAIL;
+       }
 
        memcpy(ptr, pattrib->dst, ETH_ALEN);
        memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN);