qcacld-3.0: Fix potential infinite loop in get_container_ies_len

Browse Source

In the function get_container_ies_len, len (uint32) is calculated
from the length of the buffer parsed. Then it is copied to the uint8
pnConsumed pointer from the calling function. This could lead to
pnConsumed becoming 0 if len exceeds 255 and would cause infinte
loop in the function unpack_core.

Add changes to make pnConsumed passed from unpack_core to be uint32
so that there are no issues in get_container_ies_len

Change-Id: Ia5770b4becf7dd1cf7cb97ec2e0d94f3c5f4ed54
CRs-Fixed: 2101200

...

This commit is contained in:

Vignesh Viswanathan

2017-09-19 19:01:06 +05:30

committed by Nandini Suresh

parent b4558eb67e

commit 30e69280c7

2 changed files with 296 additions and 296 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

294

core/mac/src/include/dot11f.h

File diff suppressed because it is too large Load Diff

298

core/mac/src/sys/legacy/src/utils/src/dot11f.c

File diff suppressed because it is too large Load Diff