qcacmn: Fix the integer overflow issue

In the assignment of varaible expected_field_info_size with an expression,
there might be an issue of integer overflow.

To fix this issue add a check for the expression with UINT_MAX
before assigning the expression to variable expected_field_info_size.

Change-Id: Iaa58fc164655d5b074eef55f8fd78f83a71e3fdf
CRs-Fixed: 2825846
This commit is contained in:
Abdul Muqtadeer Ahmed
2021-02-19 16:59:51 +05:30
committed by Madan Koyyalamudi
parent c2c89243d8
commit 3921edb0ae

View File

@@ -1,5 +1,5 @@
/*
* Copyright (c) 2012-2020 The Linux Foundation. All rights reserved.
* Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
*
* Permission to use, copy, modify, and/or distribute this software for
* any purpose with or without fee is hereby granted, provided that the
@@ -728,6 +728,12 @@ static int wifi_pos_parse_ani_req(const void *data, int len, int pid,
return 0;
}
if ((field_info->count - 1) >
((UINT_MAX - sizeof(*field_info)) /
sizeof(struct wifi_pos_field))) {
return OEM_ERR_INVALID_MESSAGE_LENGTH;
}
expected_field_info_size = sizeof(*field_info) +
(field_info->count - 1) * sizeof(struct wifi_pos_field);