--- drivers/net/pcmcia/wvlan_cs.c.orig	Sat Apr 13 16:29:05 2002
+++ drivers/net/pcmcia/wvlan_cs.c	Sat Apr 13 16:50:54 2002
@@ -2520,6 +2520,18 @@
 	// HCF-light doesn't support that.
 	if (local->ifb.IFB_RxStat == 0x2000 || local->ifb.IFB_RxStat == 0x4000)
 	{
+		// We copy len-12-sizeof(snap_header) bytes below.  Make sure we
+		// don't accidentally copy a negative count of bytes.
+		if (len < (12+sizeof(snap_header)))
+		{
+			DEV_KFREE_SKB(skb);
+			printk(KERN_WARNING "%s: %s dropping short packet\n",
+				dev_info, dev->name);
+			local->stats.rx_length_errors++;
+			local->stats.rx_dropped++;
+			return;
+		}
+
 		hcf_get_data(&local->ifb, 0, p, 12);
 		hcf_get_data(&local->ifb, 12+sizeof(snap_header), p+12, len-12-sizeof(snap_header));
 		skb_trim(skb, len-sizeof(snap_header));