From 06219bfc33fd04b9c83c3ee5619e20fe8906e748 Mon Sep 17 00:00:00 2001 From: Pragaspathi Thilagaraj Date: Mon, 30 Apr 2018 12:47:52 +0530 Subject: [PATCH] qcacld-3.0: Fix integer truncation in convert_wsc_opaque In the function convert_wsc_opaque, driver does copy of the new parameters present in the additional IEs of the upstream assoc request frame. While copy of the IE length pOld->length to curAddIELen, possible integer truncation could occur, as the curAddIELen is of the type uint8_t whereas pOld->length is of type uint16_t. Change the data type of curAddIELen to uint16_t. Make changes in convert_p2p_opaque and convert_wfd_opaque as well. Change-Id: Ic26660fca4a02a265bfc9553b066c7ee42f1d1f4 CRs-Fixed: 2231770 --- core/mac/src/sys/legacy/src/utils/src/utils_parser.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/core/mac/src/sys/legacy/src/utils/src/utils_parser.c b/core/mac/src/sys/legacy/src/utils/src/utils_parser.c index 07889b2f32ac..a06c4f9db1af 100644 --- a/core/mac/src/sys/legacy/src/utils/src/utils_parser.c +++ b/core/mac/src/sys/legacy/src/utils/src/utils_parser.c @@ -131,7 +131,7 @@ tSirRetStatus convert_wsc_opaque(tpAniSirGlobal pMac, { /* This is awful, I know, but the old code just rammed the IE into */ /* an opaque array. Note that we need to explicitly add the vendorIE and OUI ! */ - uint8_t curAddIELen = pOld->length; + uint16_t curAddIELen = pOld->length; pOld->length = curAddIELen + pNew->num_data + 6; pOld->addIEdata[curAddIELen++] = 0xdd; @@ -150,7 +150,7 @@ tSirRetStatus convert_p2p_opaque(tpAniSirGlobal pMac, { /* This is awful, I know, but the old code just rammed the IE into */ /* an opaque array. Note that we need to explicitly add the vendorIE and OUI ! */ - uint8_t curAddIELen = pOld->length; + uint16_t curAddIELen = pOld->length; pOld->length = curAddIELen + pNew->num_data + 6; pOld->addIEdata[curAddIELen++] = 0xdd; @@ -170,7 +170,7 @@ tSirRetStatus convert_wfd_opaque(tpAniSirGlobal pMac, { /* This is awful, I know, but the old code just rammed the IE into */ /* an opaque array. Note that we need to explicitly add the vendorIE and OUI ! */ - uint8_t curAddIELen = pOld->length; + uint16_t curAddIELen = pOld->length; pOld->length = curAddIELen + pNew->num_data + 6; pOld->addIEdata[curAddIELen++] = 0xdd;