qcacmn: handle integer underflow in util_gen_new_ie
handle integer underflow for subie_len in util_gen_new_ie Change-Id: I2f73e5a7e0462100deae1e85e6a51f77bfc46b95 CRs-Fixed: 3582487
这个提交包含在:
@@ -3074,8 +3074,9 @@ static uint32_t util_gen_new_ie(uint8_t *ie, uint32_t ielen,
|
||||
* copied to new ie, skip ssid, capability, bssid-index ie
|
||||
*/
|
||||
tmp_new = sub_copy;
|
||||
while (((tmp_new + tmp_new[1] + MIN_IE_LEN) - sub_copy) <=
|
||||
(subie_len - 1)) {
|
||||
while ((subie_len > 0) &&
|
||||
(((tmp_new + tmp_new[1] + MIN_IE_LEN) - sub_copy) <=
|
||||
(subie_len - 1))) {
|
||||
if (!(tmp_new[0] == WLAN_ELEMID_NONTX_BSSID_CAP ||
|
||||
tmp_new[0] == WLAN_ELEMID_SSID ||
|
||||
tmp_new[0] == WLAN_ELEMID_MULTI_BSSID_IDX ||
|
||||
|
在新工单中引用
屏蔽一个用户