Kaynağa Gözat

qcacld-3.0: Fix Integer overflow with latest framesc_linux tool

This is qcacld-2.0 to qcacld-3.0 propagation

In get_container_ies_len size type for len is uint8_t.
len copies values from pBufRemaining.
There can be chance for integer overflow.
To avoid that make size type for len as uint32_t.

Change-Id: I305321a6631719808ef213571974ae23b0e61bb3
CRs-Fixed: 2064580
Naveen Rawat 7 yıl önce
ebeveyn
işleme
27f1c544d6

+ 1 - 1
core/mac/src/include/dot11f.h

@@ -35,7 +35,7 @@
  *
  *
  * This file was automatically generated by 'framesc'
- * Sat Jul 29 13:54:52 2017 from the following file(s):
+ * Thu Aug 17 11:37:26 2017 from the following file(s):
  *
  * dot11f.frms
  *

+ 2 - 2
core/mac/src/sys/legacy/src/utils/src/dot11f.c

@@ -33,7 +33,7 @@
  *
  *
  * This file was automatically generated by 'framesc'
- * Sat Jul 29 13:54:52 2017 from the following file(s):
+ * Thu Aug 17 11:37:26 2017 from the following file(s):
  *
  * dot11f.frms
  *
@@ -329,7 +329,7 @@ static uint32_t get_container_ies_len(tpAniSirGlobal pCtx,
 {
 	const tIEDefn *pIe, *pIeFirst;
 	uint8_t *pBufRemaining = pBuf;
-	uint8_t len = 0;
+	uint32_t len = 0;
 	(void)pCtx;
 
 	pIeFirst = &(IEs[0]);