From b6eeed234707244c799ae7009e67312b8bf33ccd Mon Sep 17 00:00:00 2001
From: Naveen Rawat <naveenrawat@codeaurora.org>
Date: Fri, 20 Oct 2017 13:52:07 -0700
Subject: [PATCH] qcacld-3.0: Check ie_len against 255 in function
 get_container_ies_len

In function get_container_ies_len, output parameter pnConsumed is
uint8_t and poses a risk of integer overflow. Check value against 255
before assigning to output parameter.

Change-Id: I6e02037952ced13de45a6c030cc5a1e85070f5cd
CRs-Fixed: 2125781
---
 core/mac/src/include/dot11f.h                  | 2 +-
 core/mac/src/sys/legacy/src/utils/src/dot11f.c | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/core/mac/src/include/dot11f.h b/core/mac/src/include/dot11f.h
index 097bff87e4f8..da04f87b4735 100644
--- a/core/mac/src/include/dot11f.h
+++ b/core/mac/src/include/dot11f.h
@@ -35,7 +35,7 @@
  *
  *
  * This file was automatically generated by 'framesc'
- * Fri Oct 20 13:46:56 2017 from the following file(s):
+ * Fri Oct 20 13:48:39 2017 from the following file(s):
  *
  * dot11f.frms
  *
diff --git a/core/mac/src/sys/legacy/src/utils/src/dot11f.c b/core/mac/src/sys/legacy/src/utils/src/dot11f.c
index 58e9910a3956..1c698fd9816e 100644
--- a/core/mac/src/sys/legacy/src/utils/src/dot11f.c
+++ b/core/mac/src/sys/legacy/src/utils/src/dot11f.c
@@ -33,7 +33,7 @@
  *
  *
  * This file was automatically generated by 'framesc'
- * Fri Oct 20 13:46:56 2017 from the following file(s):
+ * Fri Oct 20 13:48:39 2017 from the following file(s):
  *
  * dot11f.frms
  *
@@ -349,6 +349,8 @@ static uint32_t get_container_ies_len(tpAniSirGlobal pCtx,
 		pBufRemaining += *(pBufRemaining + 1) + 2;
 	}
 
+	if (len > 0xFF)
+		return DOT11F_INTERNAL_ERROR;
 	*pnConsumed = len;
 	return DOT11F_PARSE_SUCCESS;