|
@@ -1,5 +1,5 @@
|
|
|
/*
|
|
|
- * Copyright (c) 2012-2020 The Linux Foundation. All rights reserved.
|
|
|
+ * Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
|
|
|
*
|
|
|
* Permission to use, copy, modify, and/or distribute this software for
|
|
|
* any purpose with or without fee is hereby granted, provided that the
|
|
@@ -728,6 +728,12 @@ static int wifi_pos_parse_ani_req(const void *data, int len, int pid,
|
|
|
return 0;
|
|
|
}
|
|
|
|
|
|
+ if ((field_info->count - 1) >
|
|
|
+ ((UINT_MAX - sizeof(*field_info)) /
|
|
|
+ sizeof(struct wifi_pos_field))) {
|
|
|
+ return OEM_ERR_INVALID_MESSAGE_LENGTH;
|
|
|
+ }
|
|
|
+
|
|
|
expected_field_info_size = sizeof(*field_info) +
|
|
|
(field_info->count - 1) * sizeof(struct wifi_pos_field);
|
|
|
|