Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA()

The pointer math here was totally wrong so we were reading nonsense
information from beyond the end of the buffer.  It could lead to an oops
if that memory wasn't mapped.

The "pReasonCode" pointer is assigned but never used so I deleted it.

With-Fix-From: Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
Tested-by: Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/rtl8192e/rtl819x_BAProc.c b/drivers/staging/rtl8192e/rtl819x_BAProc.c
index 60f536c295abe3ddb43e0373357b1a51a6ea1513..78ede4a817fc6a39b81c7b8c21ef2f8d7f112880 100644 (file)
--- a/drivers/staging/rtl8192e/rtl819x_BAProc.c
+++ b/drivers/staging/rtl8192e/rtl819x_BAProc.c
@@ -428,7 +428,6 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
 {
         struct rtllib_hdr_3addr *delba = NULL;
        union delba_param_set *pDelBaParamSet = NULL;
-       u16 *pReasonCode = NULL;
        u8 *dst = NULL;
 
        if (skb->len < sizeof(struct rtllib_hdr_3addr) + 6) {
@@ -453,9 +452,7 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
 #endif
        delba = (struct rtllib_hdr_3addr *)skb->data;
        dst = (u8 *)(&delba->addr2[0]);
-       delba += sizeof(struct rtllib_hdr_3addr);
-       pDelBaParamSet = (union delba_param_set *)(delba+2);
-       pReasonCode = (u16 *)(delba+4);
+       pDelBaParamSet = (union delba_param_set *)&delba->payload[2];
 
        if (pDelBaParamSet->field.Initiator == 1) {
                struct rx_ts_record *pRxTs;