From 69623ef28d1aa9472fb8c7fef5e64e0e1d0ae559 Mon Sep 17 00:00:00 2001 From: Naveen Rawat Date: Fri, 27 Apr 2018 16:11:01 -0700 Subject: [PATCH] qcacld-3.0: Avoid integer underflow in dot11f_unpack functions In function dot11f_unpack functions length of buffer passed is decremented as pointer advances in the buffer. Add a check for integer underflow before decrementing the length. Change-Id: I4ed39d326855c2027ff0bc3cbe5c8981a2ae2aa1 CRs-Fixed: 2231755 --- core/mac/src/include/dot11f.h | 15 +- .../mac/src/sys/legacy/src/utils/src/dot11f.c | 1596 ++++++++++++++++- 2 files changed, 1609 insertions(+), 2 deletions(-) diff --git a/core/mac/src/include/dot11f.h b/core/mac/src/include/dot11f.h index 983051274b83..ea4403b544b8 100644 --- a/core/mac/src/include/dot11f.h +++ b/core/mac/src/include/dot11f.h @@ -1,6 +1,9 @@ /* * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved. * + * Previously licensed under the ISC license by Qualcomm Atheros, Inc. + * + * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the * above copyright notice and this permission notice appear in all @@ -16,6 +19,12 @@ * PERFORMANCE OF THIS SOFTWARE. */ +/* + * This file was originally distributed by Qualcomm Atheros, Inc. + * under proprietary terms before Copyright ownership was assigned + * to the Linux Foundation. + */ + #ifndef DOT11F_H #define DOT11F_H /* @@ -26,7 +35,7 @@ * * * This file was automatically generated by 'framesc' - * Wed Feb 21 17:16:54 2018 from the following file(s): + * Fri Apr 27 16:11:55 2018 from the following file(s): * * dot11f.frms * @@ -48,6 +57,10 @@ typedef uint32_t tDOT11F_U64[2]; #define __must_check #endif +#if !defined unlikely +#define unlikely(x) (x) +#endif + /* * Frames Return Codes: * diff --git a/core/mac/src/sys/legacy/src/utils/src/dot11f.c b/core/mac/src/sys/legacy/src/utils/src/dot11f.c index 7b60ce7833f1..2f636723515e 100644 --- a/core/mac/src/sys/legacy/src/utils/src/dot11f.c +++ b/core/mac/src/sys/legacy/src/utils/src/dot11f.c @@ -1,6 +1,9 @@ /* * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved. * + * Previously licensed under the ISC license by Qualcomm Atheros, Inc. + * + * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the * above copyright notice and this permission notice appear in all @@ -16,6 +19,12 @@ * PERFORMANCE OF THIS SOFTWARE. */ +/* + * This file was originally distributed by Qualcomm Atheros, Inc. + * under proprietary terms before Copyright ownership was assigned + * to the Linux Foundation. + */ + /* * \file dot11f.c * @@ -24,7 +33,7 @@ * * * This file was automatically generated by 'framesc' - * Wed Feb 21 17:16:54 2018 from the following file(s): + * Fri Apr 27 16:11:55 2018 from the following file(s): * * dot11f.frms * @@ -866,6 +875,9 @@ uint32_t dot11f_unpack_tlv_authorized_ma_cs(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; + if (unlikely(tlvlen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->mac, pBuf, 6); pBuf += 6; tlvlen -= (uint8_t)6; @@ -887,6 +899,9 @@ uint32_t dot11f_unpack_tlv_version2(tpAniSirGlobal pCtx, uint32_t status = DOT11F_PARSE_SUCCESS; uint8_t tmp8__; pDst->present = 1; + if (unlikely(tlvlen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp8__ = *pBuf; pBuf += 1; tlvlen -= 1; @@ -944,9 +959,15 @@ uint32_t dot11f_unpack_tlv_extended_listen_timing(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; + if (unlikely(tlvlen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->availibilityPeriod, pBuf, 0); pBuf += 2; tlvlen -= (uint8_t)2; + if (unlikely(tlvlen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->availibilityInterval, pBuf, 0); pBuf += 2; tlvlen -= (uint8_t)2; @@ -964,12 +985,21 @@ uint32_t dot11f_unpack_tlv_listen_channel(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; + if (unlikely(tlvlen < 3)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->countryString, pBuf, 3); pBuf += 3; tlvlen -= (uint8_t)3; + if (unlikely(tlvlen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->regulatoryClass = *pBuf; pBuf += 1; tlvlen -= (uint8_t)1; + if (unlikely(tlvlen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->channel = *pBuf; pBuf += 1; tlvlen -= (uint8_t)1; @@ -1059,9 +1089,15 @@ uint32_t dot11f_unpack_tlv_notice_of_absence(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; + if (unlikely(tlvlen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->index = *pBuf; pBuf += 1; tlvlen -= (uint8_t)1; + if (unlikely(tlvlen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->CTSWindowOppPS = *pBuf; pBuf += 1; tlvlen -= (uint8_t)1; @@ -1088,12 +1124,21 @@ uint32_t dot11f_unpack_tlv_operating_channel(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; + if (unlikely(tlvlen < 3)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->countryString, pBuf, 3); pBuf += 3; tlvlen -= (uint8_t)3; + if (unlikely(tlvlen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->regulatoryClass = *pBuf; pBuf += 1; tlvlen -= (uint8_t)1; + if (unlikely(tlvlen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->channel = *pBuf; pBuf += 1; tlvlen -= (uint8_t)1; @@ -1111,9 +1156,15 @@ uint32_t dot11f_unpack_tlv_p2_p_capability(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; + if (unlikely(tlvlen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->deviceCapability = *pBuf; pBuf += 1; tlvlen -= (uint8_t)1; + if (unlikely(tlvlen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->groupCapability = *pBuf; pBuf += 1; tlvlen -= (uint8_t)1; @@ -1131,6 +1182,9 @@ uint32_t dot11f_unpack_tlv_p2_p_device_id(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; + if (unlikely(tlvlen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->P2PDeviceAddress, pBuf, 6); pBuf += 6; tlvlen -= (uint8_t)6; @@ -1155,12 +1209,21 @@ uint32_t dot11f_unpack_tlv_p2_p_device_info(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; + if (unlikely(tlvlen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->P2PDeviceAddress, pBuf, 6); pBuf += 6; tlvlen -= (uint8_t)6; + if (unlikely(tlvlen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->configMethod, pBuf, 0); pBuf += 2; tlvlen -= (uint8_t)2; + if (unlikely(tlvlen < 8)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->primaryDeviceType, pBuf, 8); pBuf += 8; tlvlen -= (uint8_t)8; @@ -1206,12 +1269,21 @@ uint32_t dot11f_unpack_tlv_primary_device_type(tpAniSirGlobal pCtx, uint32_t status = DOT11F_PARSE_SUCCESS; (void)pBuf; (void)tlvlen; /* Shutup the compiler */ pDst->present = 1; + if (unlikely(tlvlen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->primary_category, pBuf, 1); pBuf += 2; tlvlen -= (uint8_t)2; + if (unlikely(tlvlen < 4)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->oui, pBuf, 4); pBuf += 4; tlvlen -= (uint8_t)4; + if (unlikely(tlvlen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->sub_category, pBuf, 1); pBuf += 2; tlvlen -= (uint8_t)2; @@ -1232,12 +1304,21 @@ uint32_t dot11f_unpack_tlv_request_device_type(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; + if (unlikely(tlvlen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->primary_category, pBuf, 1); pBuf += 2; tlvlen -= (uint8_t)2; + if (unlikely(tlvlen < 4)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->oui, pBuf, 4); pBuf += 4; tlvlen -= (uint8_t)4; + if (unlikely(tlvlen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->sub_category, pBuf, 1); pBuf += 2; tlvlen -= (uint8_t)2; @@ -1290,6 +1371,9 @@ uint32_t dot11f_unpack_tlv_uuid_e(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; + if (unlikely(tlvlen < 16)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->uuid, pBuf, 16); pBuf += 16; tlvlen -= (uint8_t)16; @@ -1307,6 +1391,9 @@ uint32_t dot11f_unpack_tlv_uuid_r(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; + if (unlikely(tlvlen < 16)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->uuid, pBuf, 16); pBuf += 16; tlvlen -= (uint8_t)16; @@ -1338,6 +1425,9 @@ uint32_t dot11f_unpack_tlv_vendor_extension(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; + if (unlikely(tlvlen < 3)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->vendorId, pBuf, 3); pBuf += 3; tlvlen -= (uint8_t)3; @@ -1362,6 +1452,9 @@ uint32_t dot11f_unpack_tlv_version(tpAniSirGlobal pCtx, uint32_t status = DOT11F_PARSE_SUCCESS; uint8_t tmp9__; pDst->present = 1; + if (unlikely(tlvlen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp9__ = *pBuf; pBuf += 1; tlvlen -= 1; @@ -1399,6 +1492,9 @@ uint32_t dot11f_unpack_tlv_non_prefferd_chan_rep(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; + if (unlikely(tlvlen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->oper_class = *pBuf; pBuf += 1; tlvlen -= (uint8_t)1; @@ -1426,6 +1522,9 @@ uint32_t dot11f_unpack_tlv_oce_cap(tpAniSirGlobal pCtx, uint32_t status = DOT11F_PARSE_SUCCESS; uint8_t tmp10__; pDst->present = 1; + if (unlikely(tlvlen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp10__ = *pBuf; pBuf += 1; tlvlen -= 1; @@ -1448,6 +1547,9 @@ uint32_t dot11f_unpack_tlv_reduced_wan_metrics(tpAniSirGlobal pCtx, uint32_t status = DOT11F_PARSE_SUCCESS; uint8_t tmp11__; pDst->present = 1; + if (unlikely(tlvlen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp11__ = *pBuf; pBuf += 1; tlvlen -= 1; @@ -1467,9 +1569,15 @@ uint32_t dot11f_unpack_tlv_rssi_assoc_rej(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; + if (unlikely(tlvlen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->delta_rssi = *pBuf; pBuf += 1; tlvlen -= (uint8_t)1; + if (unlikely(tlvlen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->retry_delay = *pBuf; pBuf += 1; tlvlen -= (uint8_t)1; @@ -1493,6 +1601,9 @@ uint32_t dot11f_unpack_tlv_p2_p_interface(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; + if (unlikely(tlvlen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->P2PDeviceAddress, pBuf, 6); pBuf += 6; tlvlen -= (uint8_t)6; @@ -1518,14 +1629,23 @@ uint32_t dot11f_unpack_ie_gtk(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &tmp12__, pBuf, 0); pBuf += 2; ielen -= 2; pDst->keyId = tmp12__ >> 0 & 0x3; pDst->reserved = tmp12__ >> 2 & 0x3feb; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->keyLength = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 8)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->RSC, pBuf, 8); pBuf += 8; ielen -= (uint8_t)8; @@ -1554,15 +1674,27 @@ uint32_t dot11f_unpack_ie_igtk(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->keyID, pBuf, 2); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->IPN, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->keyLength = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 24)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->key, pBuf, 24); (void)pCtx; return status; @@ -1607,6 +1739,9 @@ uint32_t dot11f_unpack_ie_r1_kh_id(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->PMK_R1_ID, pBuf, 6); (void)pCtx; return status; @@ -1626,6 +1761,9 @@ uint32_t dot11f_unpack_ie_ap_channel_report(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->regulatoryClass = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -1654,6 +1792,9 @@ uint32_t dot11f_unpack_ie_bcn_reporting_detail(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->reportingDetail = *pBuf; (void)pCtx; return status; @@ -1698,9 +1839,15 @@ uint32_t dot11f_unpack_ie_beacon_reporting(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->reportingCondition = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->threshold = *pBuf; (void)pCtx; return status; @@ -1720,6 +1867,9 @@ uint32_t dot11f_unpack_ie_condensed_country_str(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->countryStr, pBuf, 2); (void)pCtx; return status; @@ -1739,6 +1889,9 @@ uint32_t dot11f_unpack_ie_measurement_pilot(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->measurementPilot = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -1762,6 +1915,9 @@ uint32_t dot11f_unpack_ie_multi_bssid(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->maxBSSIDIndicator = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -1785,12 +1941,21 @@ uint32_t dot11f_unpack_ie_ric_data(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->Identifier = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->resourceDescCount = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->statusCode, pBuf, 0); (void)pCtx; return status; @@ -1810,6 +1975,9 @@ uint32_t dot11f_unpack_ie_ric_descriptor(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->resourceType = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -1838,6 +2006,9 @@ uint32_t dot11f_unpack_ie_rrm_enabled_cap(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp13__ = *pBuf; pBuf += 1; ielen -= 1; @@ -1849,6 +2020,9 @@ uint32_t dot11f_unpack_ie_rrm_enabled_cap(tpAniSirGlobal pCtx, pDst->BeaconActive = tmp13__ >> 5 & 0x1; pDst->BeaconTable = tmp13__ >> 6 & 0x1; pDst->BeaconRepCond = tmp13__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp14__ = *pBuf; pBuf += 1; ielen -= 1; @@ -1860,6 +2034,9 @@ uint32_t dot11f_unpack_ie_rrm_enabled_cap(tpAniSirGlobal pCtx, pDst->LCIAzimuth = tmp14__ >> 5 & 0x1; pDst->TCMCapability = tmp14__ >> 6 & 0x1; pDst->triggeredTCM = tmp14__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp15__ = *pBuf; pBuf += 1; ielen -= 1; @@ -1867,6 +2044,9 @@ uint32_t dot11f_unpack_ie_rrm_enabled_cap(tpAniSirGlobal pCtx, pDst->RRMMIBEnabled = tmp15__ >> 1 & 0x1; pDst->operatingChanMax = tmp15__ >> 2 & 0x7; pDst->nonOperatinChanMax = tmp15__ >> 5 & 0x7; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp16__ = *pBuf; pBuf += 1; ielen -= 1; @@ -1876,6 +2056,9 @@ uint32_t dot11f_unpack_ie_rrm_enabled_cap(tpAniSirGlobal pCtx, pDst->RCPIMeasurement = tmp16__ >> 5 & 0x1; pDst->RSNIMeasurement = tmp16__ >> 6 & 0x1; pDst->BssAvgAccessDelay = tmp16__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp17__ = *pBuf; pDst->BSSAvailAdmission = tmp17__ >> 0 & 0x1; pDst->AntennaInformation = tmp17__ >> 1 & 0x1; @@ -1948,6 +2131,9 @@ uint32_t dot11f_unpack_ie_schedule(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &tmp18__, pBuf, 0); pBuf += 2; ielen -= 2; @@ -1955,15 +2141,27 @@ uint32_t dot11f_unpack_ie_schedule(tpAniSirGlobal pCtx, pDst->tsid = tmp18__ >> 1 & 0xf; pDst->direction = tmp18__ >> 5 & 0x3; pDst->reserved = tmp18__ >> 7 & 0x1ff; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->service_start_time, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->service_interval, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->max_service_dur, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->spec_interval, pBuf, 0); (void)pCtx; return status; @@ -1983,68 +2181,125 @@ uint32_t dot11f_unpack_ie_tclas(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->user_priority = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->classifier_type = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->classifier_mask = *pBuf; pBuf += 1; ielen -= (uint8_t)1; switch (pDst->classifier_type) { case 0: + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->info.EthParams.source, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->info.EthParams.dest, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->info.EthParams.type, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; break; case 1: + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->info.IpParams.version = *pBuf; pBuf += 1; ielen -= (uint8_t)1; switch (pDst->info.IpParams.version) { case 4: + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV4Params.source, pBuf, 4); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV4Params.dest, pBuf, 4); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->info.IpParams.params.IpV4Params.src_port, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->info.IpParams.params.IpV4Params.dest_port, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->info.IpParams.params.IpV4Params.DSCP = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->info.IpParams.params.IpV4Params.proto = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->info.IpParams.params.IpV4Params.reserved = *pBuf; pBuf += 1; ielen -= (uint8_t)1; break; case 6: + if (unlikely(ielen < 16)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV6Params.source, pBuf, 16); pBuf += 16; ielen -= (uint8_t)16; + if (unlikely(ielen < 16)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV6Params.dest, pBuf, 16); pBuf += 16; ielen -= (uint8_t)16; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->info.IpParams.params.IpV6Params.src_port, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->info.IpParams.params.IpV6Params.dest_port, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 3)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV6Params.flow_label, pBuf, 3); pBuf += 3; ielen -= (uint8_t)3; @@ -2052,6 +2307,9 @@ uint32_t dot11f_unpack_ie_tclas(tpAniSirGlobal pCtx, } break; case 2: + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->info.Params8021dq.tag_type, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; @@ -2078,6 +2336,9 @@ uint32_t dot11f_unpack_ie_ts_delay(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->delay, pBuf, 0); (void)pCtx; return status; @@ -2097,9 +2358,15 @@ uint32_t dot11f_unpack_ie_tsf_info(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->TsfOffset, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->BeaconIntvl, pBuf, 0); (void)pCtx; return status; @@ -2122,6 +2389,9 @@ uint32_t dot11f_unpack_ie_tspec(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &tmp19__, pBuf, 0); pBuf += 2; ielen -= 2; @@ -2133,55 +2403,103 @@ uint32_t dot11f_unpack_ie_tspec(tpAniSirGlobal pCtx, pDst->psb = tmp19__ >> 10 & 0x1; pDst->user_priority = tmp19__ >> 11 & 0x7; pDst->tsinfo_ack_pol = tmp19__ >> 14 & 0x3; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp20__ = *pBuf; pBuf += 1; ielen -= 1; pDst->schedule = tmp20__ >> 0 & 0x1; pDst->unused = tmp20__ >> 1 & 0x7f; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &tmp21__, pBuf, 0); pBuf += 2; ielen -= 2; pDst->size = tmp21__ >> 0 & 0x7fff; pDst->fixed = tmp21__ >> 15 & 0x1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->max_msdu_size, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->min_service_int, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->max_service_int, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->inactivity_int, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->suspension_int, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->service_start_time, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->min_data_rate, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->mean_data_rate, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->peak_data_rate, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->burst_size, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->delay_bound, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->min_phy_rate, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->surplus_bw_allowance, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->medium_time, pBuf, 0); (void)pCtx; return status; @@ -2204,6 +2522,9 @@ uint32_t dot11f_unpack_ie_vht_caps(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &tmp22__, pBuf, 0); pBuf += 4; ielen -= 4; @@ -2227,17 +2548,29 @@ uint32_t dot11f_unpack_ie_vht_caps(tpAniSirGlobal pCtx, pDst->rxAntPattern = tmp22__ >> 28 & 0x1; pDst->txAntPattern = tmp22__ >> 29 & 0x1; pDst->reserved1 = tmp22__ >> 30 & 0x3; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->rxMCSMap, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &tmp23__, pBuf, 0); pBuf += 2; ielen -= 2; pDst->rxHighSupDataRate = tmp23__ >> 0 & 0x1fff; pDst->reserved2 = tmp23__ >> 13 & 0x7; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->txMCSMap, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &tmp24__, pBuf, 0); pDst->txSupDataRate = tmp24__ >> 0 & 0x1fff; pDst->reserved3 = tmp24__ >> 13 & 0x7; @@ -2259,15 +2592,27 @@ uint32_t dot11f_unpack_ie_vht_operation(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->chanWidth = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->chanCenterFreqSeg1 = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->chanCenterFreqSeg2 = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->basicMCSSet, pBuf, 0); (void)pCtx; return status; @@ -2288,6 +2633,9 @@ uint32_t dot11f_unpack_ie_wmm_schedule(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->version = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -2295,6 +2643,9 @@ uint32_t dot11f_unpack_ie_wmm_schedule(tpAniSirGlobal pCtx, pDst->present = 0; return status | DOT11F_BAD_FIXED_VALUE; } + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &tmp25__, pBuf, 0); pBuf += 2; ielen -= 2; @@ -2302,15 +2653,27 @@ uint32_t dot11f_unpack_ie_wmm_schedule(tpAniSirGlobal pCtx, pDst->tsid = tmp25__ >> 1 & 0xf; pDst->direction = tmp25__ >> 5 & 0x3; pDst->reserved = tmp25__ >> 7 & 0x1ff; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->service_start_time, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->service_interval, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->max_service_dur, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->spec_interval, pBuf, 0); (void)pCtx; return status; @@ -2330,6 +2693,9 @@ uint32_t dot11f_unpack_ie_wmmtclas(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->version = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -2337,68 +2703,125 @@ uint32_t dot11f_unpack_ie_wmmtclas(tpAniSirGlobal pCtx, pDst->present = 0; return status | DOT11F_BAD_FIXED_VALUE; } + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->user_priority = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->classifier_type = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->classifier_mask = *pBuf; pBuf += 1; ielen -= (uint8_t)1; switch (pDst->classifier_type) { case 0: + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->info.EthParams.source, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->info.EthParams.dest, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->info.EthParams.type, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; break; case 1: + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->info.IpParams.version = *pBuf; pBuf += 1; ielen -= (uint8_t)1; switch (pDst->info.IpParams.version) { case 4: + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV4Params.source, pBuf, 4); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV4Params.dest, pBuf, 4); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->info.IpParams.params.IpV4Params.src_port, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->info.IpParams.params.IpV4Params.dest_port, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->info.IpParams.params.IpV4Params.DSCP = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->info.IpParams.params.IpV4Params.proto = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->info.IpParams.params.IpV4Params.reserved = *pBuf; pBuf += 1; ielen -= (uint8_t)1; break; case 6: + if (unlikely(ielen < 16)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV6Params.source, pBuf, 16); pBuf += 16; ielen -= (uint8_t)16; + if (unlikely(ielen < 16)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV6Params.dest, pBuf, 16); pBuf += 16; ielen -= (uint8_t)16; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->info.IpParams.params.IpV6Params.src_port, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->info.IpParams.params.IpV6Params.dest_port, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 3)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV6Params.flow_label, pBuf, 3); pBuf += 3; ielen -= (uint8_t)3; @@ -2406,6 +2829,9 @@ uint32_t dot11f_unpack_ie_wmmtclas(tpAniSirGlobal pCtx, } break; case 2: + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->info.Params8021dq.tag_type, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; @@ -2429,6 +2855,9 @@ uint32_t dot11f_unpack_ie_wmmtclasproc(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->version = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -2436,6 +2865,9 @@ uint32_t dot11f_unpack_ie_wmmtclasproc(tpAniSirGlobal pCtx, pDst->present = 0; return status | DOT11F_BAD_FIXED_VALUE; } + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->processing = *pBuf; (void)pCtx; return status; @@ -2455,6 +2887,9 @@ uint32_t dot11f_unpack_ie_wmmts_delay(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->version = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -2462,6 +2897,9 @@ uint32_t dot11f_unpack_ie_wmmts_delay(tpAniSirGlobal pCtx, pDst->present = 0; return status | DOT11F_BAD_FIXED_VALUE; } + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->delay, pBuf, 0); (void)pCtx; return status; @@ -2484,6 +2922,9 @@ uint32_t dot11f_unpack_ie_wmmtspec(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->version = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -2491,6 +2932,9 @@ uint32_t dot11f_unpack_ie_wmmtspec(tpAniSirGlobal pCtx, pDst->present = 0; return status | DOT11F_BAD_FIXED_VALUE; } + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &tmp26__, pBuf, 0); pBuf += 2; ielen -= 2; @@ -2502,55 +2946,103 @@ uint32_t dot11f_unpack_ie_wmmtspec(tpAniSirGlobal pCtx, pDst->psb = tmp26__ >> 10 & 0x1; pDst->user_priority = tmp26__ >> 11 & 0x7; pDst->tsinfo_ack_pol = tmp26__ >> 14 & 0x3; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp27__ = *pBuf; pBuf += 1; ielen -= 1; pDst->tsinfo_rsvd = tmp27__ >> 0 & 0x7f; pDst->burst_size_defn = tmp27__ >> 7 & 0x1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &tmp28__, pBuf, 0); pBuf += 2; ielen -= 2; pDst->size = tmp28__ >> 0 & 0x7fff; pDst->fixed = tmp28__ >> 15 & 0x1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->max_msdu_size, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->min_service_int, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->max_service_int, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->inactivity_int, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->suspension_int, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->service_start_time, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->min_data_rate, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->mean_data_rate, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->peak_data_rate, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->burst_size, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->delay_bound, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->min_phy_rate, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->surplus_bw_allowance, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->medium_time, pBuf, 0); (void)pCtx; return status; @@ -2570,12 +3062,21 @@ uint32_t dot11f_unpack_ie_wider_bw_chan_switch_ann(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->newChanWidth = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->newCenterChanFreq0 = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->newCenterChanFreq1 = *pBuf; (void)pCtx; return status; @@ -2595,6 +3096,9 @@ uint32_t dot11f_unpack_ie_azimuth_req(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->request = *pBuf; (void)pCtx; return status; @@ -2614,6 +3118,9 @@ uint32_t dot11f_unpack_ie_max_age(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->max_age, pBuf, 0); (void)pCtx; return status; @@ -2662,9 +3169,15 @@ uint32_t dot11f_unpack_ie_neighbor_rpt(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->bssid, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp29__ = *pBuf; pBuf += 1; ielen -= 1; @@ -2675,6 +3188,9 @@ uint32_t dot11f_unpack_ie_neighbor_rpt(tpAniSirGlobal pCtx, pDst->QosCap = tmp29__ >> 5 & 0x1; pDst->apsd = tmp29__ >> 6 & 0x1; pDst->rrm = tmp29__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp30__ = *pBuf; pBuf += 1; ielen -= 1; @@ -2682,15 +3198,27 @@ uint32_t dot11f_unpack_ie_neighbor_rpt(tpAniSirGlobal pCtx, pDst->ImmBA = tmp30__ >> 1 & 0x1; pDst->MobilityDomain = tmp30__ >> 2 & 0x1; pDst->reserved = tmp30__ >> 3 & 0x1f; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->reserved1, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->regulatoryClass = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->channel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->PhyType = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -2720,6 +3248,9 @@ uint32_t dot11f_unpack_ie_req_mac_addr(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->addr, pBuf, 6); (void)pCtx; return status; @@ -2739,6 +3270,9 @@ uint32_t dot11f_unpack_ie_tgt_mac_addr(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->addr, pBuf, 6); (void)pCtx; return status; @@ -2783,6 +3317,9 @@ uint32_t dot11f_unpack_ie_aid(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->assocId, pBuf, 0); (void)pCtx; return status; @@ -2802,15 +3339,27 @@ uint32_t dot11f_unpack_ie_cf_params(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->cfp_count = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->cfp_period = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->cfp_maxduration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->cfp_durremaining, pBuf, 0); (void)pCtx; return status; @@ -2855,12 +3404,21 @@ uint32_t dot11f_unpack_ie_chan_switch_ann(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->switchMode = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->newChannel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->switchCount = *pBuf; (void)pCtx; return status; @@ -2922,6 +3480,9 @@ uint32_t dot11f_unpack_ie_country(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 3)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->country, pBuf, 3); pBuf += 3; ielen -= (uint8_t)3; @@ -2966,12 +3527,21 @@ uint32_t dot11f_unpack_ie_edca_param_set(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->qos = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->reserved = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp31__ = *pBuf; pBuf += 1; ielen -= 1; @@ -2979,14 +3549,23 @@ uint32_t dot11f_unpack_ie_edca_param_set(tpAniSirGlobal pCtx, pDst->acbe_acm = tmp31__ >> 4 & 0x1; pDst->acbe_aci = tmp31__ >> 5 & 0x3; pDst->unused1 = tmp31__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp32__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acbe_acwmin = tmp32__ >> 0 & 0xf; pDst->acbe_acwmax = tmp32__ >> 4 & 0xf; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->acbe_txoplimit, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp33__ = *pBuf; pBuf += 1; ielen -= 1; @@ -2994,14 +3573,23 @@ uint32_t dot11f_unpack_ie_edca_param_set(tpAniSirGlobal pCtx, pDst->acbk_acm = tmp33__ >> 4 & 0x1; pDst->acbk_aci = tmp33__ >> 5 & 0x3; pDst->unused2 = tmp33__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp34__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acbk_acwmin = tmp34__ >> 0 & 0xf; pDst->acbk_acwmax = tmp34__ >> 4 & 0xf; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->acbk_txoplimit, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp35__ = *pBuf; pBuf += 1; ielen -= 1; @@ -3009,14 +3597,23 @@ uint32_t dot11f_unpack_ie_edca_param_set(tpAniSirGlobal pCtx, pDst->acvi_acm = tmp35__ >> 4 & 0x1; pDst->acvi_aci = tmp35__ >> 5 & 0x3; pDst->unused3 = tmp35__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp36__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acvi_acwmin = tmp36__ >> 0 & 0xf; pDst->acvi_acwmax = tmp36__ >> 4 & 0xf; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->acvi_txoplimit, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp37__ = *pBuf; pBuf += 1; ielen -= 1; @@ -3024,11 +3621,17 @@ uint32_t dot11f_unpack_ie_edca_param_set(tpAniSirGlobal pCtx, pDst->acvo_acm = tmp37__ >> 4 & 0x1; pDst->acvo_aci = tmp37__ >> 5 & 0x3; pDst->unused4 = tmp37__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp38__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acvo_acwmin = tmp38__ >> 0 & 0xf; pDst->acvo_acwmax = tmp38__ >> 4 & 0xf; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->acvo_txoplimit, pBuf, 0); (void)pCtx; return status; @@ -3049,6 +3652,9 @@ uint32_t dot11f_unpack_ie_erp_info(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp39__ = *pBuf; pDst->non_erp_present = tmp39__ >> 0 & 0x1; pDst->use_prot = tmp39__ >> 1 & 0x1; @@ -3098,9 +3704,15 @@ uint32_t dot11f_unpack_ie_ese_rad_mgmt_cap(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->mgmt_state = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp40__ = *pBuf; pDst->mbssid_mask = tmp40__ >> 0 & 0x7; pDst->reserved = tmp40__ >> 3 & 0x1f; @@ -3122,12 +3734,21 @@ uint32_t dot11f_unpack_ie_ese_traf_strm_met(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->tsid = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->state = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->msmt_interval, pBuf, 0); (void)pCtx; return status; @@ -3147,6 +3768,9 @@ uint32_t dot11f_unpack_ie_ese_traf_strm_rate_set(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->tsid = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -3175,9 +3799,15 @@ uint32_t dot11f_unpack_ie_ese_txmit_power(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->power_limit = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->reserved = *pBuf; (void)pCtx; return status; @@ -3197,6 +3827,9 @@ uint32_t dot11f_unpack_ie_ese_version(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->version = *pBuf; (void)pCtx; return status; @@ -3279,15 +3912,27 @@ uint32_t dot11f_unpack_ie_fh_param_set(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->dwell_time, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->hop_set = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->hop_pattern = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->hop_index = *pBuf; (void)pCtx; return status; @@ -3307,9 +3952,15 @@ uint32_t dot11f_unpack_ie_fh_params(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->radix = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->nchannels = *pBuf; (void)pCtx; return status; @@ -3329,15 +3980,27 @@ uint32_t dot11f_unpack_ie_fh_patt_table(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->flag = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->nsets = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->modulus = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->offset = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -3386,17 +4049,29 @@ uint32_t dot11f_unpack_ie_ft_info(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &tmp41__, pBuf, 0); pBuf += 2; ielen -= 2; pDst->reserved = tmp41__ >> 0 & 0xff; pDst->IECount = tmp41__ >> 8 & 0xff; + if (unlikely(ielen < 16)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->MIC, pBuf, 16); pBuf += 16; ielen -= (uint8_t)16; + if (unlikely(ielen < 32)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->Anonce, pBuf, 32); pBuf += 32; ielen -= (uint8_t)32; + if (unlikely(ielen < 32)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->Snonce, pBuf, 32); pBuf += 32; ielen -= (uint8_t)32; @@ -3431,6 +4106,9 @@ uint32_t dot11f_unpack_ie_ht_caps(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &tmp42__, pBuf, 0); pBuf += 2; ielen -= 2; @@ -3448,15 +4126,24 @@ uint32_t dot11f_unpack_ie_ht_caps(tpAniSirGlobal pCtx, pDst->psmp = tmp42__ >> 13 & 0x1; pDst->stbcControlFrame = tmp42__ >> 14 & 0x1; pDst->lsigTXOPProtection = tmp42__ >> 15 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp43__ = *pBuf; pBuf += 1; ielen -= 1; pDst->maxRxAMPDUFactor = tmp43__ >> 0 & 0x3; pDst->mpduDensity = tmp43__ >> 2 & 0x7; pDst->reserved1 = tmp43__ >> 5 & 0x7; + if (unlikely(ielen < 16)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->supportedMCSSet, pBuf, 16); pBuf += 16; ielen -= (uint8_t)16; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &tmp44__, pBuf, 0); pBuf += 2; ielen -= 2; @@ -3465,6 +4152,9 @@ uint32_t dot11f_unpack_ie_ht_caps(tpAniSirGlobal pCtx, pDst->reserved2 = tmp44__ >> 3 & 0x1f; pDst->mcsFeedback = tmp44__ >> 8 & 0x3; pDst->reserved3 = tmp44__ >> 10 & 0x3f; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &tmp45__, pBuf, 0); pBuf += 4; ielen -= 4; @@ -3484,6 +4174,9 @@ uint32_t dot11f_unpack_ie_ht_caps(tpAniSirGlobal pCtx, pDst->uncompressedSteeringMatrixBFAntennae = tmp45__ >> 21 & 0x3; pDst->compressedSteeringMatrixBFAntennae = tmp45__ >> 23 & 0x3; pDst->reserved4 = tmp45__ >> 25 & 0x7f; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp46__ = *pBuf; pBuf += 1; ielen -= 1; @@ -3523,9 +4216,15 @@ uint32_t dot11f_unpack_ie_ht_info(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->primaryChannel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp47__ = *pBuf; pBuf += 1; ielen -= 1; @@ -3534,6 +4233,9 @@ uint32_t dot11f_unpack_ie_ht_info(tpAniSirGlobal pCtx, pDst->rifsMode = tmp47__ >> 3 & 0x1; pDst->controlledAccessOnly = tmp47__ >> 4 & 0x1; pDst->serviceIntervalGranularity = tmp47__ >> 5 & 0x7; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &tmp48__, pBuf, 0); pBuf += 2; ielen -= 2; @@ -3542,6 +4244,9 @@ uint32_t dot11f_unpack_ie_ht_info(tpAniSirGlobal pCtx, pDst->transmitBurstLimit = tmp48__ >> 3 & 0x1; pDst->obssNonHTStaPresent = tmp48__ >> 4 & 0x1; pDst->reserved = tmp48__ >> 5 & 0x7ff; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &tmp49__, pBuf, 0); pBuf += 2; ielen -= 2; @@ -3552,6 +4257,9 @@ uint32_t dot11f_unpack_ie_ht_info(tpAniSirGlobal pCtx, pDst->pcoActive = tmp49__ >> 10 & 0x1; pDst->pcoPhase = tmp49__ >> 11 & 0x1; pDst->reserved2 = tmp49__ >> 12 & 0xf; + if (unlikely(ielen < 16)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->basicMCSSet, pBuf, 16); pBuf += 16; ielen -= (uint8_t)16; @@ -3580,6 +4288,9 @@ uint32_t dot11f_unpack_ie_ibss_params(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->atim, pBuf, 0); (void)pCtx; return status; @@ -3599,12 +4310,21 @@ uint32_t dot11f_unpack_ie_link_identifier(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->bssid, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->InitStaAddr, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->RespStaAddr, pBuf, 6); (void)pCtx; return status; @@ -3703,9 +4423,15 @@ uint32_t dot11f_unpack_ie_measurement_report(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->token = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp50__ = *pBuf; pBuf += 1; ielen -= 1; @@ -3713,6 +4439,9 @@ uint32_t dot11f_unpack_ie_measurement_report(tpAniSirGlobal pCtx, pDst->incapable = tmp50__ >> 1 & 0x1; pDst->refused = tmp50__ >> 2 & 0x1; pDst->unused = tmp50__ >> 3 & 0x1f; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->type = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -3721,15 +4450,27 @@ uint32_t dot11f_unpack_ie_measurement_report(tpAniSirGlobal pCtx, } else { switch (pDst->type) { case 0: + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.Basic.channel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 8)) + return DOT11F_INCOMPLETE_IE; + framesntohq(pCtx, &pDst->report.Basic.meas_start_time, pBuf, 0); pBuf += 8; ielen -= (uint8_t)8; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->report.Basic.meas_duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp51__ = *pBuf; pBuf += 1; ielen -= 1; @@ -3741,84 +4482,159 @@ uint32_t dot11f_unpack_ie_measurement_report(tpAniSirGlobal pCtx, pDst->report.Basic.unused = tmp51__ >> 5 & 0x7; break; case 1: + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.CCA.channel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 8)) + return DOT11F_INCOMPLETE_IE; + framesntohq(pCtx, &pDst->report.CCA.meas_start_time, pBuf, 0); pBuf += 8; ielen -= (uint8_t)8; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->report.CCA.meas_duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.CCA.cca_busy_fraction = *pBuf; pBuf += 1; ielen -= (uint8_t)1; break; case 2: + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.RPIHistogram.channel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 8)) + return DOT11F_INCOMPLETE_IE; + framesntohq(pCtx, &pDst->report.RPIHistogram.meas_start_time, pBuf, 0); pBuf += 8; ielen -= (uint8_t)8; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->report.RPIHistogram.meas_duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.RPIHistogram.rpi0_density = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.RPIHistogram.rpi1_density = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.RPIHistogram.rpi2_density = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.RPIHistogram.rpi3_density = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.RPIHistogram.rpi4_density = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.RPIHistogram.rpi5_density = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.RPIHistogram.rpi6_density = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.RPIHistogram.rpi7_density = *pBuf; pBuf += 1; ielen -= (uint8_t)1; break; case 5: + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.Beacon.regClass = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.Beacon.channel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 8)) + return DOT11F_INCOMPLETE_IE; + framesntohq(pCtx, &pDst->report.Beacon.meas_start_time, pBuf, 0); pBuf += 8; ielen -= (uint8_t)8; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->report.Beacon.meas_duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp52__ = *pBuf; pBuf += 1; ielen -= 1; pDst->report.Beacon.condensed_PHY = tmp52__ >> 0 & 0x7f; pDst->report.Beacon.reported_frame_type = tmp52__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.Beacon.RCPI = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.Beacon.RSNI = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->report.Beacon.BSSID, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->report.Beacon.antenna_id = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->report.Beacon.parent_TSF, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; @@ -3921,9 +4737,15 @@ uint32_t dot11f_unpack_ie_measurement_request(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->measurement_token = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp53__ = *pBuf; pBuf += 1; ielen -= 1; @@ -3933,59 +4755,107 @@ uint32_t dot11f_unpack_ie_measurement_request(tpAniSirGlobal pCtx, pDst->report = tmp53__ >> 3 & 0x1; pDst->durationMandatory = tmp53__ >> 4 & 0x1; pDst->unused = tmp53__ >> 5 & 0x7; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->measurement_type = *pBuf; pBuf += 1; ielen -= (uint8_t)1; switch (pDst->measurement_type) { case 0: + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->measurement_request.Basic.channel_no = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 8)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->measurement_request.Basic.meas_start_time, pBuf, 8); pBuf += 8; ielen -= (uint8_t)8; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->measurement_request.Basic.meas_duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; break; case 1: + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->measurement_request.CCA.channel_no = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 8)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->measurement_request.CCA.meas_start_time, pBuf, 8); pBuf += 8; ielen -= (uint8_t)8; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->measurement_request.CCA.meas_duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; break; case 2: + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->measurement_request.RPIHistogram.channel_no = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 8)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->measurement_request.RPIHistogram.meas_start_time, pBuf, 8); pBuf += 8; ielen -= (uint8_t)8; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->measurement_request.RPIHistogram.meas_duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; break; case 5: + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->measurement_request.Beacon.regClass = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->measurement_request.Beacon.channel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->measurement_request.Beacon.randomization, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->measurement_request.Beacon.meas_duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->measurement_request.Beacon.meas_mode = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->measurement_request.Beacon.BSSID, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; @@ -3998,6 +4868,9 @@ uint32_t dot11f_unpack_ie_measurement_request(tpAniSirGlobal pCtx, sizeof(*pDst), append_ie); break; case 8: + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->measurement_request.lci.loc_subject = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -4010,9 +4883,15 @@ uint32_t dot11f_unpack_ie_measurement_request(tpAniSirGlobal pCtx, sizeof(*pDst), append_ie); break; case 16: + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->measurement_request.ftmrr.random_interval, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->measurement_request.ftmrr.min_ap_count = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -4044,9 +4923,15 @@ uint32_t dot11f_unpack_ie_mobility_domain(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->MDID, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp54__ = *pBuf; pDst->overDSCap = tmp54__ >> 0 & 0x1; pDst->resourceReqCap = tmp54__ >> 1 & 0x1; @@ -4098,9 +4983,15 @@ uint32_t dot11f_unpack_ie_neighbor_report(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->bssid, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp55__ = *pBuf; pBuf += 1; ielen -= 1; @@ -4111,6 +5002,9 @@ uint32_t dot11f_unpack_ie_neighbor_report(tpAniSirGlobal pCtx, pDst->QosCap = tmp55__ >> 5 & 0x1; pDst->apsd = tmp55__ >> 6 & 0x1; pDst->rrm = tmp55__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp56__ = *pBuf; pBuf += 1; ielen -= 1; @@ -4118,15 +5012,27 @@ uint32_t dot11f_unpack_ie_neighbor_report(tpAniSirGlobal pCtx, pDst->ImmBA = tmp56__ >> 1 & 0x1; pDst->MobilityDomain = tmp56__ >> 2 & 0x1; pDst->reserved = tmp56__ >> 3 & 0x1f; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->reserved1, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->regulatoryClass = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->channel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->PhyType = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -4156,24 +5062,45 @@ uint32_t dot11f_unpack_ie_obss_scan_parameters(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->obssScanPassiveDwell, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->obssScanActiveDwell, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->bssChannelWidthTriggerScanInterval, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->obssScanPassiveTotalPerChannel, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->obssScanActiveTotalPerChannel, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->bssWidthChannelTransitionDelayFactor, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->obssScanActivityThreshold, pBuf, 0); (void)pCtx; return status; @@ -4194,6 +5121,9 @@ uint32_t dot11f_unpack_ie_operating_mode(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp57__ = *pBuf; pDst->chanWidth = tmp57__ >> 0 & 0x3; pDst->reserved = tmp57__ >> 2 & 0x3; @@ -4507,9 +5437,15 @@ uint32_t dot11f_unpack_ie_pti_control(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->tid = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->sequence_control, pBuf, 0); (void)pCtx; return status; @@ -4530,6 +5466,9 @@ uint32_t dot11f_unpack_ie_pu_buffer_status(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp58__ = *pBuf; pDst->ac_bk_traffic_aval = tmp58__ >> 0 & 0x1; pDst->ac_be_traffic_aval = tmp58__ >> 1 & 0x1; @@ -4554,9 +5493,15 @@ uint32_t dot11f_unpack_ie_power_caps(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->minTxPower = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->maxTxPower = *pBuf; (void)pCtx; return status; @@ -4576,6 +5521,9 @@ uint32_t dot11f_unpack_ie_power_constraints(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->localPowerConstraints = *pBuf; (void)pCtx; return status; @@ -4595,12 +5543,21 @@ uint32_t dot11f_unpack_ie_qbss_load(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->stacount, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->chautil = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->avail, pBuf, 0); (void)pCtx; return status; @@ -4620,6 +5577,9 @@ uint32_t dot11f_unpack_ie_QCN_IE(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->version, pBuf, 4); (void)pCtx; return status; @@ -4639,9 +5599,15 @@ uint32_t dot11f_unpack_ie_QComVendorIE(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->type = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->channel = *pBuf; (void)pCtx; return status; @@ -4662,6 +5628,9 @@ uint32_t dot11f_unpack_ie_qos_caps_ap(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp59__ = *pBuf; pDst->count = tmp59__ >> 0 & 0xf; pDst->qack = tmp59__ >> 4 & 0x1; @@ -4687,6 +5656,9 @@ uint32_t dot11f_unpack_ie_qos_caps_station(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp60__ = *pBuf; pDst->acvo_uapsd = tmp60__ >> 0 & 0x1; pDst->acvi_uapsd = tmp60__ >> 1 & 0x1; @@ -4738,15 +5710,27 @@ uint32_t dot11f_unpack_ie_quiet(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->count = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->period = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->offset, pBuf, 0); (void)pCtx; return status; @@ -4766,6 +5750,9 @@ uint32_t dot11f_unpack_ie_rcpiie(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->rcpi = *pBuf; (void)pCtx; return status; @@ -4859,10 +5846,14 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, uint32_t status = DOT11F_PARSE_SUCCESS; uint8_t def_cipher_suite[4] = {0x00, 0x0f, 0xac, 0x04}; uint8_t def_akm_suite[4] = {0x00, 0x0f, 0xac, 0x01}; + (void) pBuf; (void)ielen; /* Shutup the compiler */ if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->version, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; @@ -4884,6 +5875,9 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, return 0U; } else { pDst->gp_cipher_suite_present = 1; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + if (ielen < 4) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; @@ -4904,6 +5898,9 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, pDst->pmkid_count = 0U; return 0U; } else { + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + if (ielen < 2) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; @@ -4913,6 +5910,9 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, pBuf += 2; ielen -= (uint8_t)2; } + if (unlikely(ielen < pDst->pwise_cipher_suite_count * 4)) + return DOT11F_INCOMPLETE_IE; + if (!pDst->pwise_cipher_suite_count || pDst->pwise_cipher_suite_count > 6) { pDst->present = 0; @@ -4935,6 +5935,9 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, pDst->pmkid_count = 0U; return 0U; } else { + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + if (ielen < 2) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; @@ -4944,6 +5947,9 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, pBuf += 2; ielen -= (uint8_t)2; } + if (unlikely(ielen < pDst->akm_suite_cnt * 4)) + return DOT11F_INCOMPLETE_IE; + if (!pDst->akm_suite_cnt || pDst->akm_suite_cnt > 6) { pDst->present = 0; @@ -4965,6 +5971,9 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, return 0U; } else { pDst->RSN_Cap_present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + if (ielen < 2) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; @@ -4980,6 +5989,9 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, pDst->pmkid_count = 0U; return 0U; } else { + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + if (ielen < 2) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; @@ -4989,6 +6001,9 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, pBuf += 2; ielen -= (uint8_t)2; } + if (unlikely(ielen < pDst->pmkid_count * 16)) + return DOT11F_INCOMPLETE_IE; + if (pDst->pmkid_count > 4) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; @@ -5006,6 +6021,9 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, return 0U; } else { pDst->gp_mgmt_cipher_suite_present = 1; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + if (ielen < 4) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; @@ -5031,6 +6049,9 @@ uint32_t dot11f_unpack_ie_rsniie(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->rsni = *pBuf; (void)pCtx; return status; @@ -5158,12 +6179,21 @@ uint32_t dot11f_unpack_ie_tim(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->dtim_count = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->dtim_period = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->bmpctl = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -5192,9 +6222,15 @@ uint32_t dot11f_unpack_ie_tpc_report(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->tx_power = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->link_margin = *pBuf; (void)pCtx; return status; @@ -5232,12 +6268,21 @@ uint32_t dot11f_unpack_ie_time_advertisement(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->timing_capabilities = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 10)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->time_value, pBuf, 10); pBuf += 10; ielen -= (uint8_t)10; + if (unlikely(ielen < 5)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->time_error, pBuf, 5); (void)pCtx; return status; @@ -5257,9 +6302,15 @@ uint32_t dot11f_unpack_ie_timeout_interval(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->timeoutType = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &pDst->timeoutValue, pBuf, 0); (void)pCtx; return status; @@ -5279,18 +6330,33 @@ uint32_t dot11f_unpack_ie_vht_ext_bss_load(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->muMIMOCapStaCount = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->ssUnderUtil = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->FortyMHzUtil = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->EightyMHzUtil = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->OneSixtyMHzUtil = *pBuf; (void)pCtx; return status; @@ -5347,6 +6413,9 @@ uint32_t dot11f_unpack_ie_wapi(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->version, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; @@ -5354,9 +6423,15 @@ uint32_t dot11f_unpack_ie_wapi(tpAniSirGlobal pCtx, pDst->present = 0; return status | DOT11F_BAD_FIXED_VALUE; } + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->akm_suite_count, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < pDst->akm_suite_count * 4)) + return DOT11F_INCOMPLETE_IE; + if (pDst->akm_suite_count > 4) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; @@ -5365,9 +6440,15 @@ uint32_t dot11f_unpack_ie_wapi(tpAniSirGlobal pCtx, DOT11F_MEMCPY(pCtx, pDst->akm_suites, pBuf, (pDst->akm_suite_count * 4)); pBuf += (pDst->akm_suite_count * 4); ielen -= (pDst->akm_suite_count * 4); + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->unicast_cipher_suite_count, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < pDst->unicast_cipher_suite_count * 4)) + return DOT11F_INCOMPLETE_IE; + if (pDst->unicast_cipher_suite_count > 4) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; @@ -5376,9 +6457,15 @@ uint32_t dot11f_unpack_ie_wapi(tpAniSirGlobal pCtx, DOT11F_MEMCPY(pCtx, pDst->unicast_cipher_suites, pBuf, (pDst->unicast_cipher_suite_count * 4)); pBuf += (pDst->unicast_cipher_suite_count * 4); ielen -= (pDst->unicast_cipher_suite_count * 4); + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->multicast_cipher_suite, pBuf, 4); pBuf += 4; ielen -= (uint8_t)4; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &tmp61__, pBuf, 0); pBuf += 2; ielen -= 2; @@ -5388,10 +6475,16 @@ uint32_t dot11f_unpack_ie_wapi(tpAniSirGlobal pCtx, pDst->bkid_count = 0U; return 0U; } else { + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->bkid_count, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; } + if (unlikely(ielen < pDst->bkid_count * 16)) + return DOT11F_INCOMPLETE_IE; + if (pDst->bkid_count > 4) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; @@ -5441,9 +6534,15 @@ uint32_t dot11f_unpack_ie_wfatpc(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->txPower = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->linkMargin = *pBuf; (void)pCtx; return status; @@ -5489,6 +6588,9 @@ uint32_t dot11f_unpack_ie_wmm_caps(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->version = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -5496,6 +6598,9 @@ uint32_t dot11f_unpack_ie_wmm_caps(tpAniSirGlobal pCtx, pDst->present = 0; return status | DOT11F_BAD_FIXED_VALUE; } + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp62__ = *pBuf; pDst->reserved = tmp62__ >> 0 & 0xf; pDst->qack = tmp62__ >> 4 & 0x1; @@ -5521,9 +6626,15 @@ uint32_t dot11f_unpack_ie_wmm_info_ap(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->version = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp63__ = *pBuf; pDst->param_set_count = tmp63__ >> 0 & 0xf; pDst->reserved = tmp63__ >> 4 & 0x7; @@ -5547,9 +6658,15 @@ uint32_t dot11f_unpack_ie_wmm_info_station(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->version = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp64__ = *pBuf; pDst->acvo_uapsd = tmp64__ >> 0 & 0x1; pDst->acvi_uapsd = tmp64__ >> 1 & 0x1; @@ -5584,6 +6701,9 @@ uint32_t dot11f_unpack_ie_wmm_params(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->version = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -5591,12 +6711,21 @@ uint32_t dot11f_unpack_ie_wmm_params(tpAniSirGlobal pCtx, pDst->present = 0; return status | DOT11F_BAD_FIXED_VALUE; } + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->qosInfo = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->reserved2 = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp65__ = *pBuf; pBuf += 1; ielen -= 1; @@ -5604,14 +6733,23 @@ uint32_t dot11f_unpack_ie_wmm_params(tpAniSirGlobal pCtx, pDst->acbe_acm = tmp65__ >> 4 & 0x1; pDst->acbe_aci = tmp65__ >> 5 & 0x3; pDst->unused1 = tmp65__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp66__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acbe_acwmin = tmp66__ >> 0 & 0xf; pDst->acbe_acwmax = tmp66__ >> 4 & 0xf; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->acbe_txoplimit, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp67__ = *pBuf; pBuf += 1; ielen -= 1; @@ -5619,14 +6757,23 @@ uint32_t dot11f_unpack_ie_wmm_params(tpAniSirGlobal pCtx, pDst->acbk_acm = tmp67__ >> 4 & 0x1; pDst->acbk_aci = tmp67__ >> 5 & 0x3; pDst->unused2 = tmp67__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp68__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acbk_acwmin = tmp68__ >> 0 & 0xf; pDst->acbk_acwmax = tmp68__ >> 4 & 0xf; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->acbk_txoplimit, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp69__ = *pBuf; pBuf += 1; ielen -= 1; @@ -5634,14 +6781,23 @@ uint32_t dot11f_unpack_ie_wmm_params(tpAniSirGlobal pCtx, pDst->acvi_acm = tmp69__ >> 4 & 0x1; pDst->acvi_aci = tmp69__ >> 5 & 0x3; pDst->unused3 = tmp69__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp70__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acvi_acwmin = tmp70__ >> 0 & 0xf; pDst->acvi_acwmax = tmp70__ >> 4 & 0xf; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->acvi_txoplimit, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp71__ = *pBuf; pBuf += 1; ielen -= 1; @@ -5649,11 +6805,17 @@ uint32_t dot11f_unpack_ie_wmm_params(tpAniSirGlobal pCtx, pDst->acvo_acm = tmp71__ >> 4 & 0x1; pDst->acvo_aci = tmp71__ >> 5 & 0x3; pDst->unused4 = tmp71__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp72__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acvo_acwmin = tmp72__ >> 0 & 0xf; pDst->acvo_acwmax = tmp72__ >> 4 & 0xf; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->acvo_txoplimit, pBuf, 0); (void)pCtx; return status; @@ -5673,6 +6835,9 @@ uint32_t dot11f_unpack_ie_wpa(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->version, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; @@ -5687,6 +6852,9 @@ uint32_t dot11f_unpack_ie_wpa(tpAniSirGlobal pCtx, return 0U; } else { pDst->multicast_cipher_present = 1U; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->multicast_cipher, pBuf, 4); pBuf += 4; ielen -= (uint8_t)4; @@ -5696,10 +6864,16 @@ uint32_t dot11f_unpack_ie_wpa(tpAniSirGlobal pCtx, pDst->auth_suite_count = 0U; return 0U; } else { + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->unicast_cipher_count, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; } + if (unlikely(ielen < pDst->unicast_cipher_count * 4)) + return DOT11F_INCOMPLETE_IE; + if (pDst->unicast_cipher_count > 4) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; @@ -5712,10 +6886,16 @@ uint32_t dot11f_unpack_ie_wpa(tpAniSirGlobal pCtx, pDst->auth_suite_count = 0U; return 0U; } else { + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->auth_suite_count, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; } + if (unlikely(ielen < pDst->auth_suite_count * 4)) + return DOT11F_INCOMPLETE_IE; + if (pDst->auth_suite_count > 4) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; @@ -5727,6 +6907,9 @@ uint32_t dot11f_unpack_ie_wpa(tpAniSirGlobal pCtx, if (!ielen) { return 0U; } else { + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->caps, pBuf, 0); } (void)pCtx; @@ -6267,6 +7450,9 @@ uint32_t dot11f_unpack_ie_addba_extn_element(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp73__ = *pBuf; pDst->no_fragmentation = tmp73__ >> 0 & 0x1; pDst->he_frag_operation = tmp73__ >> 1 & 0x3; @@ -6290,9 +7476,15 @@ uint32_t dot11f_unpack_ie_bss_color_change(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->countdown = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp74__ = *pBuf; pDst->new_color = tmp74__ >> 0 & 0x3f; pDst->reserved = tmp74__ >> 6 & 0x3; @@ -6314,6 +7506,9 @@ uint32_t dot11f_unpack_ie_dh_parameter_element(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->group, pBuf, 2); pBuf += 2; ielen -= (uint8_t)2; @@ -6362,15 +7557,27 @@ uint32_t dot11f_unpack_ie_ext_chan_switch_ann(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->switch_mode = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->new_reg_class = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->new_channel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->switch_count = *pBuf; (void)pCtx; return status; @@ -6390,6 +7597,9 @@ uint32_t dot11f_unpack_ie_fils_assoc_delay_info(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->assoc_delay_info = *pBuf; (void)pCtx; return status; @@ -6409,9 +7619,15 @@ uint32_t dot11f_unpack_ie_fils_hlp_container(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->dest_mac, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; + if (unlikely(ielen < 6)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->src_mac, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; @@ -6436,6 +7652,9 @@ uint32_t dot11f_unpack_ie_fils_indication(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &tmp75__, pBuf, 0); pBuf += 2; ielen -= 2; @@ -6468,6 +7687,9 @@ uint32_t dot11f_unpack_ie_fils_kde(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 8)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->key_rsc, pBuf, 8); pBuf += 8; ielen -= (uint8_t)8; @@ -6511,6 +7733,9 @@ uint32_t dot11f_unpack_ie_fils_nonce(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 16)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->nonce, pBuf, 16); (void)pCtx; return status; @@ -6530,6 +7755,9 @@ uint32_t dot11f_unpack_ie_fils_public_key(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->key_type = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -6553,6 +7781,9 @@ uint32_t dot11f_unpack_ie_fils_session(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 8)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->session, pBuf, 8); (void)pCtx; return status; @@ -6617,6 +7848,9 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &tmp76__, pBuf, 0); pBuf += 4; ielen -= 4; @@ -6643,6 +7877,9 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, pDst->amsdu_frag = tmp76__ >> 29 & 0x1; pDst->flex_twt_sched = tmp76__ >> 30 & 0x1; pDst->rx_ctrl_frame = tmp76__ >> 31 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp77__ = *pBuf; pBuf += 1; ielen -= 1; @@ -6654,6 +7891,9 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, pDst->ops_supp = tmp77__ >> 5 & 0x1; pDst->amsdu_in_ampdu = tmp77__ >> 6 & 0x1; pDst->reserved1 = tmp77__ >> 7 & 0x1; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &tmp78__, pBuf, 0); pBuf += 4; ielen -= 4; @@ -6679,6 +7919,9 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, pDst->dcm_enc_rx = tmp78__ >> 27 & 0x7; pDst->ul_he_mu = tmp78__ >> 30 & 0x1; pDst->su_beamformer = tmp78__ >> 31 & 0x1; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &tmp79__, pBuf, 0); pBuf += 4; ielen -= 4; @@ -6702,6 +7945,9 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, pDst->max_nc = tmp79__ >> 27 & 0x7; pDst->tx_stbc_gt_80mhz = tmp79__ >> 30 & 0x1; pDst->rx_stbc_gt_80mhz = tmp79__ >> 31 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp80__ = *pBuf; pBuf += 1; ielen -= 1; @@ -6712,12 +7958,21 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, pDst->er_1x_he_ltf_gi = tmp80__ >> 4 & 0x1; pDst->midamble_rx_1x_he_ltf = tmp80__ >> 5 & 0x1; pDst->reserved2 = tmp80__ >> 6 & 0x3; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->rx_he_mcs_map_lt_80, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->tx_he_mcs_map_lt_80, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; + if (unlikely(ielen < pDst->chan_width_2 * 2)) + return DOT11F_INCOMPLETE_IE; + if (pDst->chan_width_2 > 1) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; @@ -6726,6 +7981,9 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, DOT11F_MEMCPY(pCtx, pDst->rx_he_mcs_map_160, pBuf, (pDst->chan_width_2 * 2)); pBuf += (pDst->chan_width_2 * 2); ielen -= (pDst->chan_width_2 * 2); + if (unlikely(ielen < pDst->chan_width_2 * 2)) + return DOT11F_INCOMPLETE_IE; + if (pDst->chan_width_2 > 1) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; @@ -6734,6 +7992,9 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, DOT11F_MEMCPY(pCtx, pDst->tx_he_mcs_map_160, pBuf, (pDst->chan_width_2 * 2)); pBuf += (pDst->chan_width_2 * 2); ielen -= (pDst->chan_width_2 * 2); + if (unlikely(ielen < pDst->chan_width_3 * 2)) + return DOT11F_INCOMPLETE_IE; + if (pDst->chan_width_3 > 1) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; @@ -6742,6 +8003,9 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, DOT11F_MEMCPY(pCtx, pDst->rx_he_mcs_map_80_80, pBuf, (pDst->chan_width_3 * 2)); pBuf += (pDst->chan_width_3 * 2); ielen -= (pDst->chan_width_3 * 2); + if (unlikely(ielen < pDst->chan_width_3 * 2)) + return DOT11F_INCOMPLETE_IE; + if (pDst->chan_width_3 > 1) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; @@ -6782,6 +8046,9 @@ uint32_t dot11f_unpack_ie_he_op(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 4)) + return DOT11F_INCOMPLETE_IE; + framesntohl(pCtx, &tmp81__, pBuf, 0); pBuf += 4; ielen -= 4; @@ -6796,17 +8063,29 @@ uint32_t dot11f_unpack_ie_he_op(tpAniSirGlobal pCtx, pDst->tx_bssid_ind = tmp81__ >> 29 & 0x1; pDst->bss_col_disabled = tmp81__ >> 30 & 0x1; pDst->reserved2 = tmp81__ >> 31 & 0x1; + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + DOT11F_MEMCPY(pCtx, pDst->basic_mcs_nss, pBuf, 2); pBuf += 2; ielen -= (uint8_t)2; switch (pDst->vht_oper_present) { case 1: + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->vht_oper.info.chan_width = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->vht_oper.info.center_freq_seg0 = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->vht_oper.info.center_freq_seg1 = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -6814,6 +8093,9 @@ uint32_t dot11f_unpack_ie_he_op(tpAniSirGlobal pCtx, } switch (pDst->mbssid_ap) { case 1: + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->maxbssid_ind.info.data = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -6838,6 +8120,9 @@ uint32_t dot11f_unpack_ie_hs20vendor_ie(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp82__ = *pBuf; pBuf += 1; ielen -= 1; @@ -6850,11 +8135,17 @@ uint32_t dot11f_unpack_ie_hs20vendor_ie(tpAniSirGlobal pCtx, } else { switch (pDst->hs_id_present) { case 1: + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->hs_id.pps_mo.pps_mo_id, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; break; case 2: + if (unlikely(ielen < 2)) + return DOT11F_INCOMPLETE_IE; + framesntohs(pCtx, &pDst->hs_id.anqp_domain.anqp_domain_id, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; @@ -6880,6 +8171,9 @@ uint32_t dot11f_unpack_ie_ht2040_bss_coexistence(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp83__ = *pBuf; pDst->info_request = tmp83__ >> 0 & 0x1; pDst->forty_mhz_intolerant = tmp83__ >> 1 & 0x1; @@ -6905,6 +8199,9 @@ uint32_t dot11f_unpack_ie_ht2040_bss_intolerant_report(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->operating_class = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -6941,9 +8238,15 @@ uint32_t dot11f_unpack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->qos = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp84__ = *pBuf; pBuf += 1; ielen -= 1; @@ -6951,14 +8254,23 @@ uint32_t dot11f_unpack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, pDst->acbe_acm = tmp84__ >> 4 & 0x1; pDst->acbe_aci = tmp84__ >> 5 & 0x3; pDst->unused1 = tmp84__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp85__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acbe_acwmin = tmp85__ >> 0 & 0xf; pDst->acbe_acwmax = tmp85__ >> 4 & 0xf; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->acbe_muedca_timer = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp86__ = *pBuf; pBuf += 1; ielen -= 1; @@ -6966,14 +8278,23 @@ uint32_t dot11f_unpack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, pDst->acbk_acm = tmp86__ >> 4 & 0x1; pDst->acbk_aci = tmp86__ >> 5 & 0x3; pDst->unused2 = tmp86__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp87__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acbk_acwmin = tmp87__ >> 0 & 0xf; pDst->acbk_acwmax = tmp87__ >> 4 & 0xf; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->acbk_muedca_timer = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp88__ = *pBuf; pBuf += 1; ielen -= 1; @@ -6981,14 +8302,23 @@ uint32_t dot11f_unpack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, pDst->acvi_acm = tmp88__ >> 4 & 0x1; pDst->acvi_aci = tmp88__ >> 5 & 0x3; pDst->unused3 = tmp88__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp89__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acvi_acwmin = tmp89__ >> 0 & 0xf; pDst->acvi_acwmax = tmp89__ >> 4 & 0xf; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->acvi_muedca_timer = *pBuf; pBuf += 1; ielen -= (uint8_t)1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp90__ = *pBuf; pBuf += 1; ielen -= 1; @@ -6996,11 +8326,17 @@ uint32_t dot11f_unpack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, pDst->acvo_acm = tmp90__ >> 4 & 0x1; pDst->acvo_aci = tmp90__ >> 5 & 0x3; pDst->unused4 = tmp90__ >> 7 & 0x1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + tmp91__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acvo_acwmin = tmp91__ >> 0 & 0xf; pDst->acvo_acwmax = tmp91__ >> 4 & 0xf; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->acvo_muedca_timer = *pBuf; (void)pCtx; return status; @@ -7040,6 +8376,9 @@ uint32_t dot11f_unpack_ie_sec_chan_offset_ele(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->secondaryChannelOffset = *pBuf; (void)pCtx; return status; @@ -7074,6 +8413,9 @@ uint32_t dot11f_unpack_ie_vendor_vht_ie(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; + if (unlikely(ielen < 1)) + return DOT11F_INCOMPLETE_IE; + pDst->sub_type = *pBuf; pBuf += 1; ielen -= (uint8_t)1; @@ -15913,6 +17255,9 @@ uint32_t dot11f_pack_tlv_version2(tpAniSirGlobal pCtx, tmp100__ = 0U; tmp100__ |= (pSrc->minor << 0); tmp100__ |= (pSrc->major << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp100__; *pnConsumed += 1; pBuf += 1; @@ -16882,6 +18227,9 @@ uint32_t dot11f_pack_tlv_version(tpAniSirGlobal pCtx, tmp101__ = 0U; tmp101__ |= (pSrc->minor << 0); tmp101__ |= (pSrc->major << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp101__; *pnConsumed += 1; pBuf += 1; @@ -17125,6 +18473,9 @@ uint32_t dot11f_pack_tlv_oce_cap(tpAniSirGlobal pCtx, tmp102__ |= (pSrc->is_sta_cfon << 3); tmp102__ |= (pSrc->non_oce_ap_present << 4); tmp102__ |= (pSrc->reserved << 5); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp102__; *pnConsumed += 1; pBuf += 1; @@ -17159,6 +18510,9 @@ uint32_t dot11f_pack_tlv_reduced_wan_metrics(tpAniSirGlobal pCtx, tmp103__ = 0U; tmp103__ |= (pSrc->downlink_av_cap << 0); tmp103__ |= (pSrc->uplink_av_cap << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp103__; *pnConsumed += 1; pBuf += 1; @@ -17341,6 +18695,9 @@ uint32_t dot11f_pack_ie_gtk(tpAniSirGlobal pCtx, tmp104__ = 0U; tmp104__ |= (pSrc->keyId << 0); tmp104__ |= (pSrc->reserved << 2); + if (unlikely(nBuf < 2)) + return DOT11F_INCOMPLETE_IE; + frameshtons(pCtx, pBuf, tmp104__, 0); *pnConsumed += 2; pBuf += 2; @@ -17772,6 +19129,9 @@ uint32_t dot11f_pack_ie_rrm_enabled_cap(tpAniSirGlobal pCtx, tmp105__ |= (pSrc->BeaconActive << 5); tmp105__ |= (pSrc->BeaconTable << 6); tmp105__ |= (pSrc->BeaconRepCond << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp105__; *pnConsumed += 1; pBuf += 1; @@ -17785,6 +19145,9 @@ uint32_t dot11f_pack_ie_rrm_enabled_cap(tpAniSirGlobal pCtx, tmp106__ |= (pSrc->LCIAzimuth << 5); tmp106__ |= (pSrc->TCMCapability << 6); tmp106__ |= (pSrc->triggeredTCM << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp106__; *pnConsumed += 1; pBuf += 1; @@ -17794,6 +19157,9 @@ uint32_t dot11f_pack_ie_rrm_enabled_cap(tpAniSirGlobal pCtx, tmp107__ |= (pSrc->RRMMIBEnabled << 1); tmp107__ |= (pSrc->operatingChanMax << 2); tmp107__ |= (pSrc->nonOperatinChanMax << 5); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp107__; *pnConsumed += 1; pBuf += 1; @@ -17805,6 +19171,9 @@ uint32_t dot11f_pack_ie_rrm_enabled_cap(tpAniSirGlobal pCtx, tmp108__ |= (pSrc->RCPIMeasurement << 5); tmp108__ |= (pSrc->RSNIMeasurement << 6); tmp108__ |= (pSrc->BssAvgAccessDelay << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp108__; *pnConsumed += 1; pBuf += 1; @@ -17815,6 +19184,9 @@ uint32_t dot11f_pack_ie_rrm_enabled_cap(tpAniSirGlobal pCtx, tmp109__ |= (pSrc->fine_time_meas_rpt << 2); tmp109__ |= (pSrc->lci_capability << 3); tmp109__ |= (pSrc->reserved << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp109__; *pnConsumed += 1; /* fieldsEndFlag = 1 */ @@ -17909,6 +19281,9 @@ uint32_t dot11f_pack_ie_schedule(tpAniSirGlobal pCtx, tmp110__ |= (pSrc->tsid << 1); tmp110__ |= (pSrc->direction << 5); tmp110__ |= (pSrc->reserved << 7); + if (unlikely(nBuf < 2)) + return DOT11F_INCOMPLETE_IE; + frameshtons(pCtx, pBuf, tmp110__, 0); *pnConsumed += 2; pBuf += 2; @@ -18156,6 +19531,9 @@ uint32_t dot11f_pack_ie_tspec(tpAniSirGlobal pCtx, tmp111__ |= (pSrc->psb << 10); tmp111__ |= (pSrc->user_priority << 11); tmp111__ |= (pSrc->tsinfo_ack_pol << 14); + if (unlikely(nBuf < 2)) + return DOT11F_INCOMPLETE_IE; + frameshtons(pCtx, pBuf, tmp111__, 0); *pnConsumed += 2; pBuf += 2; @@ -18163,6 +19541,9 @@ uint32_t dot11f_pack_ie_tspec(tpAniSirGlobal pCtx, tmp112__ = 0U; tmp112__ |= (pSrc->schedule << 0); tmp112__ |= (pSrc->unused << 1); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp112__; *pnConsumed += 1; pBuf += 1; @@ -18170,6 +19551,9 @@ uint32_t dot11f_pack_ie_tspec(tpAniSirGlobal pCtx, tmp113__ = 0U; tmp113__ |= (pSrc->size << 0); tmp113__ |= (pSrc->fixed << 15); + if (unlikely(nBuf < 2)) + return DOT11F_INCOMPLETE_IE; + frameshtons(pCtx, pBuf, tmp113__, 0); *pnConsumed += 2; pBuf += 2; @@ -18266,6 +19650,9 @@ uint32_t dot11f_pack_ie_vht_caps(tpAniSirGlobal pCtx, tmp114__ |= (pSrc->rxAntPattern << 28); tmp114__ |= (pSrc->txAntPattern << 29); tmp114__ |= (pSrc->reserved1 << 30); + if (unlikely(nBuf < 4)) + return DOT11F_INCOMPLETE_IE; + frameshtonl(pCtx, pBuf, tmp114__, 0); *pnConsumed += 4; pBuf += 4; @@ -18276,6 +19663,9 @@ uint32_t dot11f_pack_ie_vht_caps(tpAniSirGlobal pCtx, tmp115__ = 0U; tmp115__ |= (pSrc->rxHighSupDataRate << 0); tmp115__ |= (pSrc->reserved2 << 13); + if (unlikely(nBuf < 2)) + return DOT11F_INCOMPLETE_IE; + frameshtons(pCtx, pBuf, tmp115__, 0); *pnConsumed += 2; pBuf += 2; @@ -18286,6 +19676,9 @@ uint32_t dot11f_pack_ie_vht_caps(tpAniSirGlobal pCtx, tmp116__ = 0U; tmp116__ |= (pSrc->txSupDataRate << 0); tmp116__ |= (pSrc->reserved3 << 13); + if (unlikely(nBuf < 2)) + return DOT11F_INCOMPLETE_IE; + frameshtons(pCtx, pBuf, tmp116__, 0); *pnConsumed += 2; /* fieldsEndFlag = 1 */ @@ -18373,6 +19766,9 @@ uint32_t dot11f_pack_ie_wmm_schedule(tpAniSirGlobal pCtx, tmp117__ |= (pSrc->tsid << 1); tmp117__ |= (pSrc->direction << 5); tmp117__ |= (pSrc->reserved << 7); + if (unlikely(nBuf < 2)) + return DOT11F_INCOMPLETE_IE; + frameshtons(pCtx, pBuf, tmp117__, 0); *pnConsumed += 2; pBuf += 2; @@ -18640,6 +20036,9 @@ uint32_t dot11f_pack_ie_wmmtspec(tpAniSirGlobal pCtx, tmp118__ |= (pSrc->psb << 10); tmp118__ |= (pSrc->user_priority << 11); tmp118__ |= (pSrc->tsinfo_ack_pol << 14); + if (unlikely(nBuf < 2)) + return DOT11F_INCOMPLETE_IE; + frameshtons(pCtx, pBuf, tmp118__, 0); *pnConsumed += 2; pBuf += 2; @@ -18647,6 +20046,9 @@ uint32_t dot11f_pack_ie_wmmtspec(tpAniSirGlobal pCtx, tmp119__ = 0U; tmp119__ |= (pSrc->tsinfo_rsvd << 0); tmp119__ |= (pSrc->burst_size_defn << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp119__; *pnConsumed += 1; pBuf += 1; @@ -18654,6 +20056,9 @@ uint32_t dot11f_pack_ie_wmmtspec(tpAniSirGlobal pCtx, tmp120__ = 0U; tmp120__ |= (pSrc->size << 0); tmp120__ |= (pSrc->fixed << 15); + if (unlikely(nBuf < 2)) + return DOT11F_INCOMPLETE_IE; + frameshtons(pCtx, pBuf, tmp120__, 0); *pnConsumed += 2; pBuf += 2; @@ -18835,6 +20240,9 @@ uint32_t dot11f_pack_ie_neighbor_rpt(tpAniSirGlobal pCtx, tmp121__ |= (pSrc->QosCap << 5); tmp121__ |= (pSrc->apsd << 6); tmp121__ |= (pSrc->rrm << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp121__; *pnConsumed += 1; pBuf += 1; @@ -18844,6 +20252,9 @@ uint32_t dot11f_pack_ie_neighbor_rpt(tpAniSirGlobal pCtx, tmp122__ |= (pSrc->ImmBA << 1); tmp122__ |= (pSrc->MobilityDomain << 2); tmp122__ |= (pSrc->reserved << 3); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp122__; *pnConsumed += 1; pBuf += 1; @@ -19234,6 +20645,9 @@ uint32_t dot11f_pack_ie_edca_param_set(tpAniSirGlobal pCtx, tmp123__ |= (pSrc->acbe_acm << 4); tmp123__ |= (pSrc->acbe_aci << 5); tmp123__ |= (pSrc->unused1 << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp123__; *pnConsumed += 1; pBuf += 1; @@ -19241,6 +20655,9 @@ uint32_t dot11f_pack_ie_edca_param_set(tpAniSirGlobal pCtx, tmp124__ = 0U; tmp124__ |= (pSrc->acbe_acwmin << 0); tmp124__ |= (pSrc->acbe_acwmax << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp124__; *pnConsumed += 1; pBuf += 1; @@ -19253,6 +20670,9 @@ uint32_t dot11f_pack_ie_edca_param_set(tpAniSirGlobal pCtx, tmp125__ |= (pSrc->acbk_acm << 4); tmp125__ |= (pSrc->acbk_aci << 5); tmp125__ |= (pSrc->unused2 << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp125__; *pnConsumed += 1; pBuf += 1; @@ -19260,6 +20680,9 @@ uint32_t dot11f_pack_ie_edca_param_set(tpAniSirGlobal pCtx, tmp126__ = 0U; tmp126__ |= (pSrc->acbk_acwmin << 0); tmp126__ |= (pSrc->acbk_acwmax << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp126__; *pnConsumed += 1; pBuf += 1; @@ -19272,6 +20695,9 @@ uint32_t dot11f_pack_ie_edca_param_set(tpAniSirGlobal pCtx, tmp127__ |= (pSrc->acvi_acm << 4); tmp127__ |= (pSrc->acvi_aci << 5); tmp127__ |= (pSrc->unused3 << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp127__; *pnConsumed += 1; pBuf += 1; @@ -19279,6 +20705,9 @@ uint32_t dot11f_pack_ie_edca_param_set(tpAniSirGlobal pCtx, tmp128__ = 0U; tmp128__ |= (pSrc->acvi_acwmin << 0); tmp128__ |= (pSrc->acvi_acwmax << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp128__; *pnConsumed += 1; pBuf += 1; @@ -19291,6 +20720,9 @@ uint32_t dot11f_pack_ie_edca_param_set(tpAniSirGlobal pCtx, tmp129__ |= (pSrc->acvo_acm << 4); tmp129__ |= (pSrc->acvo_aci << 5); tmp129__ |= (pSrc->unused4 << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp129__; *pnConsumed += 1; pBuf += 1; @@ -19298,6 +20730,9 @@ uint32_t dot11f_pack_ie_edca_param_set(tpAniSirGlobal pCtx, tmp130__ = 0U; tmp130__ |= (pSrc->acvo_acwmin << 0); tmp130__ |= (pSrc->acvo_acwmax << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp130__; *pnConsumed += 1; pBuf += 1; @@ -19337,6 +20772,9 @@ uint32_t dot11f_pack_ie_erp_info(tpAniSirGlobal pCtx, tmp131__ |= (pSrc->use_prot << 1); tmp131__ |= (pSrc->barker_preamble << 2); tmp131__ |= (pSrc->unused << 3); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp131__; *pnConsumed += 1; /* fieldsEndFlag = 1 */ @@ -19419,6 +20857,9 @@ uint32_t dot11f_pack_ie_ese_rad_mgmt_cap(tpAniSirGlobal pCtx, tmp132__ = 0U; tmp132__ |= (pSrc->mbssid_mask << 0); tmp132__ |= (pSrc->reserved << 3); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp132__; *pnConsumed += 1; /* fieldsEndFlag = 1 */ @@ -19785,6 +21226,9 @@ uint32_t dot11f_pack_ie_ft_info(tpAniSirGlobal pCtx, tmp133__ = 0U; tmp133__ |= (pSrc->reserved << 0); tmp133__ |= (pSrc->IECount << 8); + if (unlikely(nBuf < 2)) + return DOT11F_INCOMPLETE_IE; + frameshtons(pCtx, pBuf, tmp133__, 0); *pnConsumed += 2; pBuf += 2; @@ -19851,6 +21295,9 @@ uint32_t dot11f_pack_ie_ht_caps(tpAniSirGlobal pCtx, tmp134__ |= (pSrc->psmp << 13); tmp134__ |= (pSrc->stbcControlFrame << 14); tmp134__ |= (pSrc->lsigTXOPProtection << 15); + if (unlikely(nBuf < 2)) + return DOT11F_INCOMPLETE_IE; + frameshtons(pCtx, pBuf, tmp134__, 0); *pnConsumed += 2; pBuf += 2; @@ -19859,6 +21306,9 @@ uint32_t dot11f_pack_ie_ht_caps(tpAniSirGlobal pCtx, tmp135__ |= (pSrc->maxRxAMPDUFactor << 0); tmp135__ |= (pSrc->mpduDensity << 2); tmp135__ |= (pSrc->reserved1 << 5); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp135__; *pnConsumed += 1; pBuf += 1; @@ -19872,6 +21322,9 @@ uint32_t dot11f_pack_ie_ht_caps(tpAniSirGlobal pCtx, tmp136__ |= (pSrc->reserved2 << 3); tmp136__ |= (pSrc->mcsFeedback << 8); tmp136__ |= (pSrc->reserved3 << 10); + if (unlikely(nBuf < 2)) + return DOT11F_INCOMPLETE_IE; + frameshtons(pCtx, pBuf, tmp136__, 0); *pnConsumed += 2; pBuf += 2; @@ -19893,6 +21346,9 @@ uint32_t dot11f_pack_ie_ht_caps(tpAniSirGlobal pCtx, tmp137__ |= (pSrc->uncompressedSteeringMatrixBFAntennae << 21); tmp137__ |= (pSrc->compressedSteeringMatrixBFAntennae << 23); tmp137__ |= (pSrc->reserved4 << 25); + if (unlikely(nBuf < 4)) + return DOT11F_INCOMPLETE_IE; + frameshtonl(pCtx, pBuf, tmp137__, 0); *pnConsumed += 4; pBuf += 4; @@ -19906,6 +21362,9 @@ uint32_t dot11f_pack_ie_ht_caps(tpAniSirGlobal pCtx, tmp138__ |= (pSrc->rxAS << 5); tmp138__ |= (pSrc->txSoundingPPDUs << 6); tmp138__ |= (pSrc->reserved5 << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp138__; *pnConsumed += 1; pBuf += 1; @@ -19951,6 +21410,9 @@ uint32_t dot11f_pack_ie_ht_info(tpAniSirGlobal pCtx, tmp139__ |= (pSrc->rifsMode << 3); tmp139__ |= (pSrc->controlledAccessOnly << 4); tmp139__ |= (pSrc->serviceIntervalGranularity << 5); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp139__; *pnConsumed += 1; pBuf += 1; @@ -19961,6 +21423,9 @@ uint32_t dot11f_pack_ie_ht_info(tpAniSirGlobal pCtx, tmp140__ |= (pSrc->transmitBurstLimit << 3); tmp140__ |= (pSrc->obssNonHTStaPresent << 4); tmp140__ |= (pSrc->reserved << 5); + if (unlikely(nBuf < 2)) + return DOT11F_INCOMPLETE_IE; + frameshtons(pCtx, pBuf, tmp140__, 0); *pnConsumed += 2; pBuf += 2; @@ -19973,6 +21438,9 @@ uint32_t dot11f_pack_ie_ht_info(tpAniSirGlobal pCtx, tmp141__ |= (pSrc->pcoActive << 10); tmp141__ |= (pSrc->pcoPhase << 11); tmp141__ |= (pSrc->reserved2 << 12); + if (unlikely(nBuf < 2)) + return DOT11F_INCOMPLETE_IE; + frameshtons(pCtx, pBuf, tmp141__, 0); *pnConsumed += 2; pBuf += 2; @@ -20135,6 +21603,9 @@ uint32_t dot11f_pack_ie_measurement_report(tpAniSirGlobal pCtx, tmp142__ |= (pSrc->incapable << 1); tmp142__ |= (pSrc->refused << 2); tmp142__ |= (pSrc->unused << 3); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp142__; *pnConsumed += 1; pBuf += 1; @@ -20161,6 +21632,9 @@ uint32_t dot11f_pack_ie_measurement_report(tpAniSirGlobal pCtx, tmp143__ |= (pSrc->report.Basic.rader << 3); tmp143__ |= (pSrc->report.Basic.unmeasured << 4); tmp143__ |= (pSrc->report.Basic.unused << 5); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp143__; *pnConsumed += 1; /* fieldsEndFlag = 1 */ @@ -20231,6 +21705,9 @@ uint32_t dot11f_pack_ie_measurement_report(tpAniSirGlobal pCtx, tmp144__ = 0U; tmp144__ |= (pSrc->report.Beacon.condensed_PHY << 0); tmp144__ |= (pSrc->report.Beacon.reported_frame_type << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp144__; *pnConsumed += 1; pBuf += 1; @@ -20302,6 +21779,9 @@ uint32_t dot11f_pack_ie_measurement_request(tpAniSirGlobal pCtx, tmp145__ |= (pSrc->report << 3); tmp145__ |= (pSrc->durationMandatory << 4); tmp145__ |= (pSrc->unused << 5); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp145__; *pnConsumed += 1; pBuf += 1; @@ -20432,6 +21912,9 @@ uint32_t dot11f_pack_ie_mobility_domain(tpAniSirGlobal pCtx, tmp146__ |= (pSrc->overDSCap << 0); tmp146__ |= (pSrc->resourceReqCap << 1); tmp146__ |= (pSrc->reserved << 2); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp146__; *pnConsumed += 1; /* fieldsEndFlag = 1 */ @@ -20478,6 +21961,9 @@ uint32_t dot11f_pack_ie_neighbor_report(tpAniSirGlobal pCtx, tmp147__ |= (pSrc->QosCap << 5); tmp147__ |= (pSrc->apsd << 6); tmp147__ |= (pSrc->rrm << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp147__; *pnConsumed += 1; pBuf += 1; @@ -20487,6 +21973,9 @@ uint32_t dot11f_pack_ie_neighbor_report(tpAniSirGlobal pCtx, tmp148__ |= (pSrc->ImmBA << 1); tmp148__ |= (pSrc->MobilityDomain << 2); tmp148__ |= (pSrc->reserved << 3); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp148__; *pnConsumed += 1; pBuf += 1; @@ -20589,6 +22078,9 @@ uint32_t dot11f_pack_ie_operating_mode(tpAniSirGlobal pCtx, tmp149__ |= (pSrc->reserved << 2); tmp149__ |= (pSrc->rxNSS << 4); tmp149__ |= (pSrc->rxNSSType << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp149__; *pnConsumed += 1; /* fieldsEndFlag = 1 */ @@ -21079,6 +22571,9 @@ uint32_t dot11f_pack_ie_pu_buffer_status(tpAniSirGlobal pCtx, tmp150__ |= (pSrc->ac_vi_traffic_aval << 2); tmp150__ |= (pSrc->ac_vo_traffic_aval << 3); tmp150__ |= (pSrc->reserved << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp150__; *pnConsumed += 1; /* fieldsEndFlag = 1 */ @@ -21287,6 +22782,9 @@ uint32_t dot11f_pack_ie_qos_caps_ap(tpAniSirGlobal pCtx, tmp151__ |= (pSrc->qreq << 5); tmp151__ |= (pSrc->txopreq << 6); tmp151__ |= (pSrc->reserved << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp151__; *pnConsumed += 1; /* fieldsEndFlag = 1 */ @@ -21326,6 +22824,9 @@ uint32_t dot11f_pack_ie_qos_caps_station(tpAniSirGlobal pCtx, tmp152__ |= (pSrc->qack << 4); tmp152__ |= (pSrc->max_sp_length << 5); tmp152__ |= (pSrc->more_data_ack << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp152__; *pnConsumed += 1; /* fieldsEndFlag = 1 */ @@ -22000,6 +23501,9 @@ uint32_t dot11f_pack_ie_wapi(tpAniSirGlobal pCtx, tmp153__ = 0U; tmp153__ |= (pSrc->preauth << 0); tmp153__ |= (pSrc->reserved << 1); + if (unlikely(nBuf < 2)) + return DOT11F_INCOMPLETE_IE; + frameshtons(pCtx, pBuf, tmp153__, 0); *pnConsumed += 2; pBuf += 2; @@ -22168,6 +23672,9 @@ uint32_t dot11f_pack_ie_wmm_caps(tpAniSirGlobal pCtx, tmp154__ |= (pSrc->queue_request << 5); tmp154__ |= (pSrc->txop_request << 6); tmp154__ |= (pSrc->more_ack << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp154__; *pnConsumed += 1; /* fieldsEndFlag = 1 */ @@ -22216,6 +23723,9 @@ uint32_t dot11f_pack_ie_wmm_info_ap(tpAniSirGlobal pCtx, tmp155__ |= (pSrc->param_set_count << 0); tmp155__ |= (pSrc->reserved << 4); tmp155__ |= (pSrc->uapsd << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp155__; *pnConsumed += 1; /* fieldsEndFlag = 1 */ @@ -22268,6 +23778,9 @@ uint32_t dot11f_pack_ie_wmm_info_station(tpAniSirGlobal pCtx, tmp156__ |= (pSrc->reserved1 << 4); tmp156__ |= (pSrc->max_sp_length << 5); tmp156__ |= (pSrc->reserved2 << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp156__; *pnConsumed += 1; /* fieldsEndFlag = 1 */ @@ -22330,6 +23843,9 @@ uint32_t dot11f_pack_ie_wmm_params(tpAniSirGlobal pCtx, tmp157__ |= (pSrc->acbe_acm << 4); tmp157__ |= (pSrc->acbe_aci << 5); tmp157__ |= (pSrc->unused1 << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp157__; *pnConsumed += 1; pBuf += 1; @@ -22337,6 +23853,9 @@ uint32_t dot11f_pack_ie_wmm_params(tpAniSirGlobal pCtx, tmp158__ = 0U; tmp158__ |= (pSrc->acbe_acwmin << 0); tmp158__ |= (pSrc->acbe_acwmax << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp158__; *pnConsumed += 1; pBuf += 1; @@ -22349,6 +23868,9 @@ uint32_t dot11f_pack_ie_wmm_params(tpAniSirGlobal pCtx, tmp159__ |= (pSrc->acbk_acm << 4); tmp159__ |= (pSrc->acbk_aci << 5); tmp159__ |= (pSrc->unused2 << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp159__; *pnConsumed += 1; pBuf += 1; @@ -22356,6 +23878,9 @@ uint32_t dot11f_pack_ie_wmm_params(tpAniSirGlobal pCtx, tmp160__ = 0U; tmp160__ |= (pSrc->acbk_acwmin << 0); tmp160__ |= (pSrc->acbk_acwmax << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp160__; *pnConsumed += 1; pBuf += 1; @@ -22368,6 +23893,9 @@ uint32_t dot11f_pack_ie_wmm_params(tpAniSirGlobal pCtx, tmp161__ |= (pSrc->acvi_acm << 4); tmp161__ |= (pSrc->acvi_aci << 5); tmp161__ |= (pSrc->unused3 << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp161__; *pnConsumed += 1; pBuf += 1; @@ -22375,6 +23903,9 @@ uint32_t dot11f_pack_ie_wmm_params(tpAniSirGlobal pCtx, tmp162__ = 0U; tmp162__ |= (pSrc->acvi_acwmin << 0); tmp162__ |= (pSrc->acvi_acwmax << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp162__; *pnConsumed += 1; pBuf += 1; @@ -22387,6 +23918,9 @@ uint32_t dot11f_pack_ie_wmm_params(tpAniSirGlobal pCtx, tmp163__ |= (pSrc->acvo_acm << 4); tmp163__ |= (pSrc->acvo_aci << 5); tmp163__ |= (pSrc->unused4 << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp163__; *pnConsumed += 1; pBuf += 1; @@ -22394,6 +23928,9 @@ uint32_t dot11f_pack_ie_wmm_params(tpAniSirGlobal pCtx, tmp164__ = 0U; tmp164__ |= (pSrc->acvo_acwmin << 0); tmp164__ |= (pSrc->acvo_acwmax << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp164__; *pnConsumed += 1; pBuf += 1; @@ -22964,6 +24501,9 @@ uint32_t dot11f_pack_ie_addba_extn_element(tpAniSirGlobal pCtx, tmp165__ |= (pSrc->no_fragmentation << 0); tmp165__ |= (pSrc->he_frag_operation << 1); tmp165__ |= (pSrc->reserved << 3); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp165__; *pnConsumed += 1; /* fieldsEndFlag = 1 */ @@ -23003,6 +24543,9 @@ uint32_t dot11f_pack_ie_bss_color_change(tpAniSirGlobal pCtx, tmp166__ = 0U; tmp166__ |= (pSrc->new_color << 0); tmp166__ |= (pSrc->reserved << 6); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp166__; *pnConsumed += 1; /* fieldsEndFlag = 1 */ @@ -23215,6 +24758,9 @@ uint32_t dot11f_pack_ie_fils_indication(tpAniSirGlobal pCtx, tmp167__ |= (pSrc->is_fils_sk_auth_pfs_supported << 10); tmp167__ |= (pSrc->is_pk_auth_supported << 11); tmp167__ |= (pSrc->reserved << 12); + if (unlikely(nBuf < 2)) + return DOT11F_INCOMPLETE_IE; + frameshtons(pCtx, pBuf, tmp167__, 0); *pnConsumed += 2; pBuf += 2; @@ -23503,6 +25049,9 @@ uint32_t dot11f_pack_ie_he_cap(tpAniSirGlobal pCtx, tmp168__ |= (pSrc->amsdu_frag << 29); tmp168__ |= (pSrc->flex_twt_sched << 30); tmp168__ |= (pSrc->rx_ctrl_frame << 31); + if (unlikely(nBuf < 4)) + return DOT11F_INCOMPLETE_IE; + frameshtonl(pCtx, pBuf, tmp168__, 0); *pnConsumed += 4; pBuf += 4; @@ -23516,6 +25065,9 @@ uint32_t dot11f_pack_ie_he_cap(tpAniSirGlobal pCtx, tmp169__ |= (pSrc->ops_supp << 5); tmp169__ |= (pSrc->amsdu_in_ampdu << 6); tmp169__ |= (pSrc->reserved1 << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp169__; *pnConsumed += 1; pBuf += 1; @@ -23543,6 +25095,9 @@ uint32_t dot11f_pack_ie_he_cap(tpAniSirGlobal pCtx, tmp170__ |= (pSrc->dcm_enc_rx << 27); tmp170__ |= (pSrc->ul_he_mu << 30); tmp170__ |= (pSrc->su_beamformer << 31); + if (unlikely(nBuf < 4)) + return DOT11F_INCOMPLETE_IE; + frameshtonl(pCtx, pBuf, tmp170__, 0); *pnConsumed += 4; pBuf += 4; @@ -23568,6 +25123,9 @@ uint32_t dot11f_pack_ie_he_cap(tpAniSirGlobal pCtx, tmp171__ |= (pSrc->max_nc << 27); tmp171__ |= (pSrc->tx_stbc_gt_80mhz << 30); tmp171__ |= (pSrc->rx_stbc_gt_80mhz << 31); + if (unlikely(nBuf < 4)) + return DOT11F_INCOMPLETE_IE; + frameshtonl(pCtx, pBuf, tmp171__, 0); *pnConsumed += 4; pBuf += 4; @@ -23580,6 +25138,9 @@ uint32_t dot11f_pack_ie_he_cap(tpAniSirGlobal pCtx, tmp172__ |= (pSrc->er_1x_he_ltf_gi << 4); tmp172__ |= (pSrc->midamble_rx_1x_he_ltf << 5); tmp172__ |= (pSrc->reserved2 << 6); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp172__; *pnConsumed += 1; pBuf += 1; @@ -23657,6 +25218,9 @@ uint32_t dot11f_pack_ie_he_op(tpAniSirGlobal pCtx, tmp173__ |= (pSrc->tx_bssid_ind << 29); tmp173__ |= (pSrc->bss_col_disabled << 30); tmp173__ |= (pSrc->reserved2 << 31); + if (unlikely(nBuf < 4)) + return DOT11F_INCOMPLETE_IE; + frameshtonl(pCtx, pBuf, tmp173__, 0); *pnConsumed += 4; pBuf += 4; @@ -23735,6 +25299,9 @@ uint32_t dot11f_pack_ie_hs20vendor_ie(tpAniSirGlobal pCtx, tmp174__ |= (pSrc->hs_id_present << 1); tmp174__ |= (pSrc->reserved << 3); tmp174__ |= (pSrc->release_num << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp174__; *pnConsumed += 1; pBuf += 1; @@ -23789,6 +25356,9 @@ uint32_t dot11f_pack_ie_ht2040_bss_coexistence(tpAniSirGlobal pCtx, tmp175__ |= (pSrc->obss_scan_exemption_req << 3); tmp175__ |= (pSrc->obss_scan_exemption_grant << 4); tmp175__ |= (pSrc->unused << 5); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp175__; *pnConsumed += 1; /* fieldsEndFlag = 1 */ @@ -23869,6 +25439,9 @@ uint32_t dot11f_pack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, tmp176__ |= (pSrc->acbe_acm << 4); tmp176__ |= (pSrc->acbe_aci << 5); tmp176__ |= (pSrc->unused1 << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp176__; *pnConsumed += 1; pBuf += 1; @@ -23876,6 +25449,9 @@ uint32_t dot11f_pack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, tmp177__ = 0U; tmp177__ |= (pSrc->acbe_acwmin << 0); tmp177__ |= (pSrc->acbe_acwmax << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp177__; *pnConsumed += 1; pBuf += 1; @@ -23888,6 +25464,9 @@ uint32_t dot11f_pack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, tmp178__ |= (pSrc->acbk_acm << 4); tmp178__ |= (pSrc->acbk_aci << 5); tmp178__ |= (pSrc->unused2 << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp178__; *pnConsumed += 1; pBuf += 1; @@ -23895,6 +25474,9 @@ uint32_t dot11f_pack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, tmp179__ = 0U; tmp179__ |= (pSrc->acbk_acwmin << 0); tmp179__ |= (pSrc->acbk_acwmax << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp179__; *pnConsumed += 1; pBuf += 1; @@ -23907,6 +25489,9 @@ uint32_t dot11f_pack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, tmp180__ |= (pSrc->acvi_acm << 4); tmp180__ |= (pSrc->acvi_aci << 5); tmp180__ |= (pSrc->unused3 << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp180__; *pnConsumed += 1; pBuf += 1; @@ -23914,6 +25499,9 @@ uint32_t dot11f_pack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, tmp181__ = 0U; tmp181__ |= (pSrc->acvi_acwmin << 0); tmp181__ |= (pSrc->acvi_acwmax << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp181__; *pnConsumed += 1; pBuf += 1; @@ -23926,6 +25514,9 @@ uint32_t dot11f_pack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, tmp182__ |= (pSrc->acvo_acm << 4); tmp182__ |= (pSrc->acvo_aci << 5); tmp182__ |= (pSrc->unused4 << 7); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp182__; *pnConsumed += 1; pBuf += 1; @@ -23933,6 +25524,9 @@ uint32_t dot11f_pack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, tmp183__ = 0U; tmp183__ |= (pSrc->acvo_acwmin << 0); tmp183__ |= (pSrc->acvo_acwmax << 4); + if (unlikely(nBuf < 1)) + return DOT11F_INCOMPLETE_IE; + *pBuf = tmp183__; *pnConsumed += 1; pBuf += 1;