A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 08:07:32 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix integer truncation in convert_wsc_opaque

Browse source 
In the function convert_wsc_opaque, driver does copy of the
new parameters present in the additional IEs of the upstream
assoc request frame. While copy of the IE length pOld->length to
curAddIELen, possible integer truncation could occur, as the
curAddIELen is of the type uint8_t whereas pOld->length is of
type uint16_t.

Change the data type of curAddIELen to uint16_t. Make changes in
convert_p2p_opaque and convert_wfd_opaque as well.

Change-Id: Ic26660fca4a02a265bfc9553b066c7ee42f1d1f4
CRs-Fixed: 2231770
This commit is contained in:
Pragaspathi Thilagaraj 2018-04-30 12:47:52 +05:30 • committed by nshrivas
commit 06219bfc33
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
core/mac/src/sys/legacy/src/utils/src/utils_parser.c
View file

@ -131,7 +131,7 @@ tSirRetStatus convert_wsc_opaque(tpAniSirGlobal pMac,
{
/* This is awful, I know, but the old code just rammed the IE into */
/* an opaque array. Note that we need to explicitly add the vendorIE and OUI ! */
uint8_t curAddIELen = pOld->length;
uint16_t curAddIELen = pOld->length;
pOld->length = curAddIELen + pNew->num_data + 6;
pOld->addIEdata[curAddIELen++] = 0xdd;
@ -150,7 +150,7 @@ tSirRetStatus convert_p2p_opaque(tpAniSirGlobal pMac,
{
/* This is awful, I know, but the old code just rammed the IE into */
/* an opaque array. Note that we need to explicitly add the vendorIE and OUI ! */
uint8_t curAddIELen = pOld->length;
uint16_t curAddIELen = pOld->length;
pOld->length = curAddIELen + pNew->num_data + 6;
pOld->addIEdata[curAddIELen++] = 0xdd;
@ -170,7 +170,7 @@ tSirRetStatus convert_wfd_opaque(tpAniSirGlobal pMac,
{
/* This is awful, I know, but the old code just rammed the IE into */
/* an opaque array. Note that we need to explicitly add the vendorIE and OUI ! */
uint8_t curAddIELen = pOld->length;
uint16_t curAddIELen = pOld->length;
pOld->length = curAddIELen + pNew->num_data + 6;
pOld->addIEdata[curAddIELen++] = 0xdd;