Browse Source

qcacld-3.0: Check ie_len against 255 in function get_container_ies_len

In function get_container_ies_len, output parameter pnConsumed is
uint8_t and poses a risk of integer overflow. Check value against 255
before assigning to output parameter.

Change-Id: I6e02037952ced13de45a6c030cc5a1e85070f5cd
CRs-Fixed: 2125781
Naveen Rawat 7 years ago
parent
commit
b6eeed2347
2 changed files with 4 additions and 2 deletions
  1. 1 1
      core/mac/src/include/dot11f.h
  2. 3 1
      core/mac/src/sys/legacy/src/utils/src/dot11f.c

+ 1 - 1
core/mac/src/include/dot11f.h

@@ -35,7 +35,7 @@
  *
  *
  * This file was automatically generated by 'framesc'
- * Fri Oct 20 13:46:56 2017 from the following file(s):
+ * Fri Oct 20 13:48:39 2017 from the following file(s):
  *
  * dot11f.frms
  *

+ 3 - 1
core/mac/src/sys/legacy/src/utils/src/dot11f.c

@@ -33,7 +33,7 @@
  *
  *
  * This file was automatically generated by 'framesc'
- * Fri Oct 20 13:46:56 2017 from the following file(s):
+ * Fri Oct 20 13:48:39 2017 from the following file(s):
  *
  * dot11f.frms
  *
@@ -349,6 +349,8 @@ static uint32_t get_container_ies_len(tpAniSirGlobal pCtx,
 		pBufRemaining += *(pBufRemaining + 1) + 2;
 	}
 
+	if (len > 0xFF)
+		return DOT11F_INTERNAL_ERROR;
 	*pnConsumed = len;
 	return DOT11F_PARSE_SUCCESS;