samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: handle integer underflow in util_gen_new_ie

Browse Source 
handle integer underflow for subie_len in util_gen_new_ie

Change-Id: I2f73e5a7e0462100deae1e85e6a51f77bfc46b95
CRs-Fixed: 3582487
This commit is contained in:
Guru Pratap Sharma
2023-08-11 00:13:30 -07:00
committed by Rahul Choudhary
parent 8d3856c308
commit dbd510c42c
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
umac/scan/dispatcher/src/wlan_scan_utils_api.c
View File

@@ -3074,8 +3074,9 @@ static uint32_t util_gen_new_ie(uint8_t *ie, uint32_t ielen,
* copied to new ie, skip ssid, capability, bssid-index ie * copied to new ie, skip ssid, capability, bssid-index ie
*/ */
tmp_new = sub_copy; tmp_new = sub_copy;
while (((tmp_new + tmp_new[1] + MIN_IE_LEN) - sub_copy) <= while ((subie_len > 0) &&
(subie_len - 1)) { (((tmp_new + tmp_new[1] + MIN_IE_LEN) - sub_copy) <=
(subie_len - 1))) {
if (!(tmp_new[0] == WLAN_ELEMID_NONTX_BSSID_CAP || if (!(tmp_new[0] == WLAN_ELEMID_NONTX_BSSID_CAP ||
tmp_new[0] == WLAN_ELEMID_SSID || tmp_new[0] == WLAN_ELEMID_SSID ||
tmp_new[0] == WLAN_ELEMID_MULTI_BSSID_IDX || tmp_new[0] == WLAN_ELEMID_MULTI_BSSID_IDX ||