.. | .. |
---|
3625 | 3625 | frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]); |
---|
3626 | 3626 | frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]); |
---|
3627 | 3627 | |
---|
| 3628 | + if (frame_data_len < sizeof(struct ieee80211_hdr_3addr) || |
---|
| 3629 | + frame_data_len > IEEE80211_MAX_DATA_LEN) |
---|
| 3630 | + goto err; |
---|
| 3631 | + |
---|
3628 | 3632 | /* Allocate new skb here */ |
---|
3629 | 3633 | skb = alloc_skb(frame_data_len, GFP_KERNEL); |
---|
3630 | 3634 | if (skb == NULL) |
---|
3631 | | - goto err; |
---|
3632 | | - |
---|
3633 | | - if (frame_data_len > IEEE80211_MAX_DATA_LEN) |
---|
3634 | 3635 | goto err; |
---|
3635 | 3636 | |
---|
3636 | 3637 | /* Copy the data */ |
---|