From 89e85d4f6a0cd1b75a276ef7be3d1cf0c74bf022 Mon Sep 17 00:00:00 2001 From: Naveen Rawat Date: Wed, 23 May 2018 11:54:27 -0700 Subject: [PATCH] qcacld-3.0: Fix incomplete IE handling in dot11 unpack functions If in dot11f_unpack functions, check for integer underflow fails, the function returns failure but does not set the present field of the IE. This present field of the structure is used to check if IE is present. So even if the unpack failed the IE structure is considered valid. Change-Id: I8f572db43a869e48a151ea37dc5b9a2c1fe34eea CRs-Fixed: 2246426 --- core/mac/src/include/dot11f.h | 2 +- .../mac/src/sys/legacy/src/utils/src/dot11f.c | 1811 ++++++++++++----- 2 files changed, 1328 insertions(+), 485 deletions(-) diff --git a/core/mac/src/include/dot11f.h b/core/mac/src/include/dot11f.h index c6c0313d0cdb..b7ff210d02a9 100644 --- a/core/mac/src/include/dot11f.h +++ b/core/mac/src/include/dot11f.h @@ -26,7 +26,7 @@ * * * This file was automatically generated by 'framesc' - * Thu May 10 17:05:13 2018 from the following file(s): + * Wed May 23 11:54:08 2018 from the following file(s): * * dot11f.frms * diff --git a/core/mac/src/sys/legacy/src/utils/src/dot11f.c b/core/mac/src/sys/legacy/src/utils/src/dot11f.c index eedbba22e7fd..dab3eeaaae11 100644 --- a/core/mac/src/sys/legacy/src/utils/src/dot11f.c +++ b/core/mac/src/sys/legacy/src/utils/src/dot11f.c @@ -24,7 +24,7 @@ * * * This file was automatically generated by 'framesc' - * Thu May 10 17:05:13 2018 from the following file(s): + * Wed May 23 11:54:08 2018 from the following file(s): * * dot11f.frms * @@ -867,8 +867,10 @@ uint32_t dot11f_unpack_tlv_authorized_ma_cs(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; - if (unlikely(tlvlen < 6)) + if (unlikely(tlvlen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->mac, pBuf, 6); pBuf += 6; @@ -891,8 +893,10 @@ uint32_t dot11f_unpack_tlv_version2(tpAniSirGlobal pCtx, uint32_t status = DOT11F_PARSE_SUCCESS; uint8_t tmp8__; pDst->present = 1; - if (unlikely(tlvlen < 1)) + if (unlikely(tlvlen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp8__ = *pBuf; pBuf += 1; @@ -951,14 +955,18 @@ uint32_t dot11f_unpack_tlv_extended_listen_timing(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; - if (unlikely(tlvlen < 2)) + if (unlikely(tlvlen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->availibilityPeriod, pBuf, 0); pBuf += 2; tlvlen -= (uint8_t)2; - if (unlikely(tlvlen < 2)) + if (unlikely(tlvlen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->availibilityInterval, pBuf, 0); pBuf += 2; @@ -977,20 +985,26 @@ uint32_t dot11f_unpack_tlv_listen_channel(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; - if (unlikely(tlvlen < 3)) + if (unlikely(tlvlen < 3)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->countryString, pBuf, 3); pBuf += 3; tlvlen -= (uint8_t)3; - if (unlikely(tlvlen < 1)) + if (unlikely(tlvlen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->regulatoryClass = *pBuf; pBuf += 1; tlvlen -= (uint8_t)1; - if (unlikely(tlvlen < 1)) + if (unlikely(tlvlen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->channel = *pBuf; pBuf += 1; @@ -1081,14 +1095,18 @@ uint32_t dot11f_unpack_tlv_notice_of_absence(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; - if (unlikely(tlvlen < 1)) + if (unlikely(tlvlen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->index = *pBuf; pBuf += 1; tlvlen -= (uint8_t)1; - if (unlikely(tlvlen < 1)) + if (unlikely(tlvlen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->CTSWindowOppPS = *pBuf; pBuf += 1; @@ -1116,20 +1134,26 @@ uint32_t dot11f_unpack_tlv_operating_channel(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; - if (unlikely(tlvlen < 3)) + if (unlikely(tlvlen < 3)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->countryString, pBuf, 3); pBuf += 3; tlvlen -= (uint8_t)3; - if (unlikely(tlvlen < 1)) + if (unlikely(tlvlen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->regulatoryClass = *pBuf; pBuf += 1; tlvlen -= (uint8_t)1; - if (unlikely(tlvlen < 1)) + if (unlikely(tlvlen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->channel = *pBuf; pBuf += 1; @@ -1148,14 +1172,18 @@ uint32_t dot11f_unpack_tlv_p2_p_capability(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; - if (unlikely(tlvlen < 1)) + if (unlikely(tlvlen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->deviceCapability = *pBuf; pBuf += 1; tlvlen -= (uint8_t)1; - if (unlikely(tlvlen < 1)) + if (unlikely(tlvlen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->groupCapability = *pBuf; pBuf += 1; @@ -1174,8 +1202,10 @@ uint32_t dot11f_unpack_tlv_p2_p_device_id(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; - if (unlikely(tlvlen < 6)) + if (unlikely(tlvlen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->P2PDeviceAddress, pBuf, 6); pBuf += 6; @@ -1201,20 +1231,26 @@ uint32_t dot11f_unpack_tlv_p2_p_device_info(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; - if (unlikely(tlvlen < 6)) + if (unlikely(tlvlen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->P2PDeviceAddress, pBuf, 6); pBuf += 6; tlvlen -= (uint8_t)6; - if (unlikely(tlvlen < 2)) + if (unlikely(tlvlen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->configMethod, pBuf, 0); pBuf += 2; tlvlen -= (uint8_t)2; - if (unlikely(tlvlen < 8)) + if (unlikely(tlvlen < 8)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->primaryDeviceType, pBuf, 8); pBuf += 8; @@ -1261,20 +1297,26 @@ uint32_t dot11f_unpack_tlv_primary_device_type(tpAniSirGlobal pCtx, uint32_t status = DOT11F_PARSE_SUCCESS; (void)pBuf; (void)tlvlen; /* Shutup the compiler */ pDst->present = 1; - if (unlikely(tlvlen < 2)) + if (unlikely(tlvlen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->primary_category, pBuf, 1); pBuf += 2; tlvlen -= (uint8_t)2; - if (unlikely(tlvlen < 4)) + if (unlikely(tlvlen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->oui, pBuf, 4); pBuf += 4; tlvlen -= (uint8_t)4; - if (unlikely(tlvlen < 2)) + if (unlikely(tlvlen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->sub_category, pBuf, 1); pBuf += 2; @@ -1296,20 +1338,26 @@ uint32_t dot11f_unpack_tlv_request_device_type(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; - if (unlikely(tlvlen < 2)) + if (unlikely(tlvlen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->primary_category, pBuf, 1); pBuf += 2; tlvlen -= (uint8_t)2; - if (unlikely(tlvlen < 4)) + if (unlikely(tlvlen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->oui, pBuf, 4); pBuf += 4; tlvlen -= (uint8_t)4; - if (unlikely(tlvlen < 2)) + if (unlikely(tlvlen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->sub_category, pBuf, 1); pBuf += 2; @@ -1363,8 +1411,10 @@ uint32_t dot11f_unpack_tlv_uuid_e(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; - if (unlikely(tlvlen < 16)) + if (unlikely(tlvlen < 16)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->uuid, pBuf, 16); pBuf += 16; @@ -1383,8 +1433,10 @@ uint32_t dot11f_unpack_tlv_uuid_r(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; - if (unlikely(tlvlen < 16)) + if (unlikely(tlvlen < 16)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->uuid, pBuf, 16); pBuf += 16; @@ -1417,8 +1469,10 @@ uint32_t dot11f_unpack_tlv_vendor_extension(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; - if (unlikely(tlvlen < 3)) + if (unlikely(tlvlen < 3)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->vendorId, pBuf, 3); pBuf += 3; @@ -1444,8 +1498,10 @@ uint32_t dot11f_unpack_tlv_version(tpAniSirGlobal pCtx, uint32_t status = DOT11F_PARSE_SUCCESS; uint8_t tmp9__; pDst->present = 1; - if (unlikely(tlvlen < 1)) + if (unlikely(tlvlen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp9__ = *pBuf; pBuf += 1; @@ -1484,8 +1540,10 @@ uint32_t dot11f_unpack_tlv_non_prefferd_chan_rep(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; - if (unlikely(tlvlen < 1)) + if (unlikely(tlvlen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->oper_class = *pBuf; pBuf += 1; @@ -1514,8 +1572,10 @@ uint32_t dot11f_unpack_tlv_oce_cap(tpAniSirGlobal pCtx, uint32_t status = DOT11F_PARSE_SUCCESS; uint8_t tmp10__; pDst->present = 1; - if (unlikely(tlvlen < 1)) + if (unlikely(tlvlen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp10__ = *pBuf; pBuf += 1; @@ -1539,8 +1599,10 @@ uint32_t dot11f_unpack_tlv_reduced_wan_metrics(tpAniSirGlobal pCtx, uint32_t status = DOT11F_PARSE_SUCCESS; uint8_t tmp11__; pDst->present = 1; - if (unlikely(tlvlen < 1)) + if (unlikely(tlvlen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp11__ = *pBuf; pBuf += 1; @@ -1561,14 +1623,18 @@ uint32_t dot11f_unpack_tlv_rssi_assoc_rej(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; - if (unlikely(tlvlen < 1)) + if (unlikely(tlvlen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->delta_rssi = *pBuf; pBuf += 1; tlvlen -= (uint8_t)1; - if (unlikely(tlvlen < 1)) + if (unlikely(tlvlen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->retry_delay = *pBuf; pBuf += 1; @@ -1593,8 +1659,10 @@ uint32_t dot11f_unpack_tlv_p2_p_interface(tpAniSirGlobal pCtx, { uint32_t status = DOT11F_PARSE_SUCCESS; pDst->present = 1; - if (unlikely(tlvlen < 6)) + if (unlikely(tlvlen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->P2PDeviceAddress, pBuf, 6); pBuf += 6; @@ -1621,22 +1689,28 @@ uint32_t dot11f_unpack_ie_gtk(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &tmp12__, pBuf, 0); pBuf += 2; ielen -= 2; pDst->keyId = tmp12__ >> 0 & 0x3; pDst->reserved = tmp12__ >> 2 & 0x3feb; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->keyLength = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 8)) + if (unlikely(ielen < 8)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->RSC, pBuf, 8); pBuf += 8; @@ -1666,26 +1740,34 @@ uint32_t dot11f_unpack_ie_igtk(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->keyID, pBuf, 2); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->IPN, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->keyLength = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 24)) + if (unlikely(ielen < 24)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->key, pBuf, 24); (void)pCtx; @@ -1731,8 +1813,10 @@ uint32_t dot11f_unpack_ie_r1_kh_id(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->PMK_R1_ID, pBuf, 6); (void)pCtx; @@ -1753,8 +1837,10 @@ uint32_t dot11f_unpack_ie_ap_channel_report(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->regulatoryClass = *pBuf; pBuf += 1; @@ -1784,8 +1870,10 @@ uint32_t dot11f_unpack_ie_bcn_reporting_detail(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->reportingDetail = *pBuf; (void)pCtx; @@ -1831,14 +1919,18 @@ uint32_t dot11f_unpack_ie_beacon_reporting(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->reportingCondition = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->threshold = *pBuf; (void)pCtx; @@ -1859,8 +1951,10 @@ uint32_t dot11f_unpack_ie_condensed_country_str(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->countryStr, pBuf, 2); (void)pCtx; @@ -1881,8 +1975,10 @@ uint32_t dot11f_unpack_ie_measurement_pilot(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->measurementPilot = *pBuf; pBuf += 1; @@ -1907,8 +2003,10 @@ uint32_t dot11f_unpack_ie_multi_bssid(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->maxBSSIDIndicator = *pBuf; pBuf += 1; @@ -1933,20 +2031,26 @@ uint32_t dot11f_unpack_ie_ric_data(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->Identifier = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->resourceDescCount = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->statusCode, pBuf, 0); (void)pCtx; @@ -1967,8 +2071,10 @@ uint32_t dot11f_unpack_ie_ric_descriptor(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->resourceType = *pBuf; pBuf += 1; @@ -1998,8 +2104,10 @@ uint32_t dot11f_unpack_ie_rrm_enabled_cap(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp13__ = *pBuf; pBuf += 1; @@ -2012,8 +2120,10 @@ uint32_t dot11f_unpack_ie_rrm_enabled_cap(tpAniSirGlobal pCtx, pDst->BeaconActive = tmp13__ >> 5 & 0x1; pDst->BeaconTable = tmp13__ >> 6 & 0x1; pDst->BeaconRepCond = tmp13__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp14__ = *pBuf; pBuf += 1; @@ -2026,8 +2136,10 @@ uint32_t dot11f_unpack_ie_rrm_enabled_cap(tpAniSirGlobal pCtx, pDst->LCIAzimuth = tmp14__ >> 5 & 0x1; pDst->TCMCapability = tmp14__ >> 6 & 0x1; pDst->triggeredTCM = tmp14__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp15__ = *pBuf; pBuf += 1; @@ -2036,8 +2148,10 @@ uint32_t dot11f_unpack_ie_rrm_enabled_cap(tpAniSirGlobal pCtx, pDst->RRMMIBEnabled = tmp15__ >> 1 & 0x1; pDst->operatingChanMax = tmp15__ >> 2 & 0x7; pDst->nonOperatinChanMax = tmp15__ >> 5 & 0x7; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp16__ = *pBuf; pBuf += 1; @@ -2048,8 +2162,10 @@ uint32_t dot11f_unpack_ie_rrm_enabled_cap(tpAniSirGlobal pCtx, pDst->RCPIMeasurement = tmp16__ >> 5 & 0x1; pDst->RSNIMeasurement = tmp16__ >> 6 & 0x1; pDst->BssAvgAccessDelay = tmp16__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp17__ = *pBuf; pDst->BSSAvailAdmission = tmp17__ >> 0 & 0x1; @@ -2123,8 +2239,10 @@ uint32_t dot11f_unpack_ie_schedule(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &tmp18__, pBuf, 0); pBuf += 2; @@ -2133,26 +2251,34 @@ uint32_t dot11f_unpack_ie_schedule(tpAniSirGlobal pCtx, pDst->tsid = tmp18__ >> 1 & 0xf; pDst->direction = tmp18__ >> 5 & 0x3; pDst->reserved = tmp18__ >> 7 & 0x1ff; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->service_start_time, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->service_interval, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->max_service_dur, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->spec_interval, pBuf, 0); (void)pCtx; @@ -2173,124 +2299,162 @@ uint32_t dot11f_unpack_ie_tclas(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->user_priority = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->classifier_type = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->classifier_mask = *pBuf; pBuf += 1; ielen -= (uint8_t)1; switch (pDst->classifier_type) { case 0: - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->info.EthParams.source, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->info.EthParams.dest, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->info.EthParams.type, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; break; case 1: - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->info.IpParams.version = *pBuf; pBuf += 1; ielen -= (uint8_t)1; switch (pDst->info.IpParams.version) { case 4: - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV4Params.source, pBuf, 4); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV4Params.dest, pBuf, 4); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->info.IpParams.params.IpV4Params.src_port, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->info.IpParams.params.IpV4Params.dest_port, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->info.IpParams.params.IpV4Params.DSCP = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->info.IpParams.params.IpV4Params.proto = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->info.IpParams.params.IpV4Params.reserved = *pBuf; pBuf += 1; ielen -= (uint8_t)1; break; case 6: - if (unlikely(ielen < 16)) + if (unlikely(ielen < 16)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV6Params.source, pBuf, 16); pBuf += 16; ielen -= (uint8_t)16; - if (unlikely(ielen < 16)) + if (unlikely(ielen < 16)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV6Params.dest, pBuf, 16); pBuf += 16; ielen -= (uint8_t)16; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->info.IpParams.params.IpV6Params.src_port, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->info.IpParams.params.IpV6Params.dest_port, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 3)) + if (unlikely(ielen < 3)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV6Params.flow_label, pBuf, 3); pBuf += 3; @@ -2299,8 +2463,10 @@ uint32_t dot11f_unpack_ie_tclas(tpAniSirGlobal pCtx, } break; case 2: - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->info.Params8021dq.tag_type, pBuf, 0); pBuf += 2; @@ -2328,8 +2494,10 @@ uint32_t dot11f_unpack_ie_ts_delay(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->delay, pBuf, 0); (void)pCtx; @@ -2350,14 +2518,18 @@ uint32_t dot11f_unpack_ie_tsf_info(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->TsfOffset, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->BeaconIntvl, pBuf, 0); (void)pCtx; @@ -2381,8 +2553,10 @@ uint32_t dot11f_unpack_ie_tspec(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &tmp19__, pBuf, 0); pBuf += 2; @@ -2395,102 +2569,134 @@ uint32_t dot11f_unpack_ie_tspec(tpAniSirGlobal pCtx, pDst->psb = tmp19__ >> 10 & 0x1; pDst->user_priority = tmp19__ >> 11 & 0x7; pDst->tsinfo_ack_pol = tmp19__ >> 14 & 0x3; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp20__ = *pBuf; pBuf += 1; ielen -= 1; pDst->schedule = tmp20__ >> 0 & 0x1; pDst->unused = tmp20__ >> 1 & 0x7f; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &tmp21__, pBuf, 0); pBuf += 2; ielen -= 2; pDst->size = tmp21__ >> 0 & 0x7fff; pDst->fixed = tmp21__ >> 15 & 0x1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->max_msdu_size, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->min_service_int, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->max_service_int, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->inactivity_int, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->suspension_int, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->service_start_time, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->min_data_rate, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->mean_data_rate, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->peak_data_rate, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->burst_size, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->delay_bound, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->min_phy_rate, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->surplus_bw_allowance, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->medium_time, pBuf, 0); (void)pCtx; @@ -2514,8 +2720,10 @@ uint32_t dot11f_unpack_ie_vht_caps(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &tmp22__, pBuf, 0); pBuf += 4; @@ -2540,28 +2748,36 @@ uint32_t dot11f_unpack_ie_vht_caps(tpAniSirGlobal pCtx, pDst->rxAntPattern = tmp22__ >> 28 & 0x1; pDst->txAntPattern = tmp22__ >> 29 & 0x1; pDst->reserved1 = tmp22__ >> 30 & 0x3; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->rxMCSMap, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &tmp23__, pBuf, 0); pBuf += 2; ielen -= 2; pDst->rxHighSupDataRate = tmp23__ >> 0 & 0x1fff; pDst->reserved2 = tmp23__ >> 13 & 0x7; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->txMCSMap, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &tmp24__, pBuf, 0); pDst->txSupDataRate = tmp24__ >> 0 & 0x1fff; @@ -2584,26 +2800,34 @@ uint32_t dot11f_unpack_ie_vht_operation(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->chanWidth = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->chanCenterFreqSeg1 = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->chanCenterFreqSeg2 = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->basicMCSSet, pBuf, 0); (void)pCtx; @@ -2625,8 +2849,10 @@ uint32_t dot11f_unpack_ie_wmm_schedule(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->version = *pBuf; pBuf += 1; @@ -2635,8 +2861,10 @@ uint32_t dot11f_unpack_ie_wmm_schedule(tpAniSirGlobal pCtx, pDst->present = 0; return status | DOT11F_BAD_FIXED_VALUE; } - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &tmp25__, pBuf, 0); pBuf += 2; @@ -2645,26 +2873,34 @@ uint32_t dot11f_unpack_ie_wmm_schedule(tpAniSirGlobal pCtx, pDst->tsid = tmp25__ >> 1 & 0xf; pDst->direction = tmp25__ >> 5 & 0x3; pDst->reserved = tmp25__ >> 7 & 0x1ff; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->service_start_time, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->service_interval, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->max_service_dur, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->spec_interval, pBuf, 0); (void)pCtx; @@ -2685,8 +2921,10 @@ uint32_t dot11f_unpack_ie_wmmtclas(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->version = *pBuf; pBuf += 1; @@ -2695,124 +2933,162 @@ uint32_t dot11f_unpack_ie_wmmtclas(tpAniSirGlobal pCtx, pDst->present = 0; return status | DOT11F_BAD_FIXED_VALUE; } - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->user_priority = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->classifier_type = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->classifier_mask = *pBuf; pBuf += 1; ielen -= (uint8_t)1; switch (pDst->classifier_type) { case 0: - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->info.EthParams.source, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->info.EthParams.dest, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->info.EthParams.type, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; break; case 1: - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->info.IpParams.version = *pBuf; pBuf += 1; ielen -= (uint8_t)1; switch (pDst->info.IpParams.version) { case 4: - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV4Params.source, pBuf, 4); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV4Params.dest, pBuf, 4); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->info.IpParams.params.IpV4Params.src_port, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->info.IpParams.params.IpV4Params.dest_port, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->info.IpParams.params.IpV4Params.DSCP = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->info.IpParams.params.IpV4Params.proto = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->info.IpParams.params.IpV4Params.reserved = *pBuf; pBuf += 1; ielen -= (uint8_t)1; break; case 6: - if (unlikely(ielen < 16)) + if (unlikely(ielen < 16)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV6Params.source, pBuf, 16); pBuf += 16; ielen -= (uint8_t)16; - if (unlikely(ielen < 16)) + if (unlikely(ielen < 16)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV6Params.dest, pBuf, 16); pBuf += 16; ielen -= (uint8_t)16; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->info.IpParams.params.IpV6Params.src_port, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->info.IpParams.params.IpV6Params.dest_port, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 3)) + if (unlikely(ielen < 3)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->info.IpParams.params.IpV6Params.flow_label, pBuf, 3); pBuf += 3; @@ -2821,8 +3097,10 @@ uint32_t dot11f_unpack_ie_wmmtclas(tpAniSirGlobal pCtx, } break; case 2: - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->info.Params8021dq.tag_type, pBuf, 0); pBuf += 2; @@ -2847,8 +3125,10 @@ uint32_t dot11f_unpack_ie_wmmtclasproc(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->version = *pBuf; pBuf += 1; @@ -2857,8 +3137,10 @@ uint32_t dot11f_unpack_ie_wmmtclasproc(tpAniSirGlobal pCtx, pDst->present = 0; return status | DOT11F_BAD_FIXED_VALUE; } - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->processing = *pBuf; (void)pCtx; @@ -2879,8 +3161,10 @@ uint32_t dot11f_unpack_ie_wmmts_delay(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->version = *pBuf; pBuf += 1; @@ -2889,8 +3173,10 @@ uint32_t dot11f_unpack_ie_wmmts_delay(tpAniSirGlobal pCtx, pDst->present = 0; return status | DOT11F_BAD_FIXED_VALUE; } - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->delay, pBuf, 0); (void)pCtx; @@ -2914,8 +3200,10 @@ uint32_t dot11f_unpack_ie_wmmtspec(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->version = *pBuf; pBuf += 1; @@ -2924,8 +3212,10 @@ uint32_t dot11f_unpack_ie_wmmtspec(tpAniSirGlobal pCtx, pDst->present = 0; return status | DOT11F_BAD_FIXED_VALUE; } - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &tmp26__, pBuf, 0); pBuf += 2; @@ -2938,102 +3228,134 @@ uint32_t dot11f_unpack_ie_wmmtspec(tpAniSirGlobal pCtx, pDst->psb = tmp26__ >> 10 & 0x1; pDst->user_priority = tmp26__ >> 11 & 0x7; pDst->tsinfo_ack_pol = tmp26__ >> 14 & 0x3; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp27__ = *pBuf; pBuf += 1; ielen -= 1; pDst->tsinfo_rsvd = tmp27__ >> 0 & 0x7f; pDst->burst_size_defn = tmp27__ >> 7 & 0x1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &tmp28__, pBuf, 0); pBuf += 2; ielen -= 2; pDst->size = tmp28__ >> 0 & 0x7fff; pDst->fixed = tmp28__ >> 15 & 0x1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->max_msdu_size, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->min_service_int, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->max_service_int, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->inactivity_int, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->suspension_int, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->service_start_time, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->min_data_rate, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->mean_data_rate, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->peak_data_rate, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->burst_size, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->delay_bound, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->min_phy_rate, pBuf, 0); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->surplus_bw_allowance, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->medium_time, pBuf, 0); (void)pCtx; @@ -3054,20 +3376,26 @@ uint32_t dot11f_unpack_ie_wider_bw_chan_switch_ann(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->newChanWidth = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->newCenterChanFreq0 = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->newCenterChanFreq1 = *pBuf; (void)pCtx; @@ -3088,8 +3416,10 @@ uint32_t dot11f_unpack_ie_azimuth_req(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->request = *pBuf; (void)pCtx; @@ -3110,8 +3440,10 @@ uint32_t dot11f_unpack_ie_max_age(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->max_age, pBuf, 0); (void)pCtx; @@ -3161,14 +3493,18 @@ uint32_t dot11f_unpack_ie_neighbor_rpt(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->bssid, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp29__ = *pBuf; pBuf += 1; @@ -3180,8 +3516,10 @@ uint32_t dot11f_unpack_ie_neighbor_rpt(tpAniSirGlobal pCtx, pDst->QosCap = tmp29__ >> 5 & 0x1; pDst->apsd = tmp29__ >> 6 & 0x1; pDst->rrm = tmp29__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp30__ = *pBuf; pBuf += 1; @@ -3190,26 +3528,34 @@ uint32_t dot11f_unpack_ie_neighbor_rpt(tpAniSirGlobal pCtx, pDst->ImmBA = tmp30__ >> 1 & 0x1; pDst->MobilityDomain = tmp30__ >> 2 & 0x1; pDst->reserved = tmp30__ >> 3 & 0x1f; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->reserved1, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->regulatoryClass = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->channel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->PhyType = *pBuf; pBuf += 1; @@ -3240,8 +3586,10 @@ uint32_t dot11f_unpack_ie_req_mac_addr(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->addr, pBuf, 6); (void)pCtx; @@ -3262,8 +3610,10 @@ uint32_t dot11f_unpack_ie_tgt_mac_addr(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->addr, pBuf, 6); (void)pCtx; @@ -3309,8 +3659,10 @@ uint32_t dot11f_unpack_ie_aid(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->assocId, pBuf, 0); (void)pCtx; @@ -3331,26 +3683,34 @@ uint32_t dot11f_unpack_ie_cf_params(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->cfp_count = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->cfp_period = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->cfp_maxduration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->cfp_durremaining, pBuf, 0); (void)pCtx; @@ -3396,20 +3756,26 @@ uint32_t dot11f_unpack_ie_chan_switch_ann(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->switchMode = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->newChannel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->switchCount = *pBuf; (void)pCtx; @@ -3472,8 +3838,10 @@ uint32_t dot11f_unpack_ie_country(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 3)) + if (unlikely(ielen < 3)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->country, pBuf, 3); pBuf += 3; @@ -3519,20 +3887,26 @@ uint32_t dot11f_unpack_ie_edca_param_set(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->qos = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->reserved = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp31__ = *pBuf; pBuf += 1; @@ -3541,22 +3915,28 @@ uint32_t dot11f_unpack_ie_edca_param_set(tpAniSirGlobal pCtx, pDst->acbe_acm = tmp31__ >> 4 & 0x1; pDst->acbe_aci = tmp31__ >> 5 & 0x3; pDst->unused1 = tmp31__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp32__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acbe_acwmin = tmp32__ >> 0 & 0xf; pDst->acbe_acwmax = tmp32__ >> 4 & 0xf; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->acbe_txoplimit, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp33__ = *pBuf; pBuf += 1; @@ -3565,22 +3945,28 @@ uint32_t dot11f_unpack_ie_edca_param_set(tpAniSirGlobal pCtx, pDst->acbk_acm = tmp33__ >> 4 & 0x1; pDst->acbk_aci = tmp33__ >> 5 & 0x3; pDst->unused2 = tmp33__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp34__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acbk_acwmin = tmp34__ >> 0 & 0xf; pDst->acbk_acwmax = tmp34__ >> 4 & 0xf; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->acbk_txoplimit, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp35__ = *pBuf; pBuf += 1; @@ -3589,22 +3975,28 @@ uint32_t dot11f_unpack_ie_edca_param_set(tpAniSirGlobal pCtx, pDst->acvi_acm = tmp35__ >> 4 & 0x1; pDst->acvi_aci = tmp35__ >> 5 & 0x3; pDst->unused3 = tmp35__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp36__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acvi_acwmin = tmp36__ >> 0 & 0xf; pDst->acvi_acwmax = tmp36__ >> 4 & 0xf; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->acvi_txoplimit, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp37__ = *pBuf; pBuf += 1; @@ -3613,16 +4005,20 @@ uint32_t dot11f_unpack_ie_edca_param_set(tpAniSirGlobal pCtx, pDst->acvo_acm = tmp37__ >> 4 & 0x1; pDst->acvo_aci = tmp37__ >> 5 & 0x3; pDst->unused4 = tmp37__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp38__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acvo_acwmin = tmp38__ >> 0 & 0xf; pDst->acvo_acwmax = tmp38__ >> 4 & 0xf; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->acvo_txoplimit, pBuf, 0); (void)pCtx; @@ -3644,8 +4040,10 @@ uint32_t dot11f_unpack_ie_erp_info(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp39__ = *pBuf; pDst->non_erp_present = tmp39__ >> 0 & 0x1; @@ -3696,14 +4094,18 @@ uint32_t dot11f_unpack_ie_ese_rad_mgmt_cap(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->mgmt_state = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp40__ = *pBuf; pDst->mbssid_mask = tmp40__ >> 0 & 0x7; @@ -3726,20 +4128,26 @@ uint32_t dot11f_unpack_ie_ese_traf_strm_met(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->tsid = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->state = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->msmt_interval, pBuf, 0); (void)pCtx; @@ -3760,8 +4168,10 @@ uint32_t dot11f_unpack_ie_ese_traf_strm_rate_set(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->tsid = *pBuf; pBuf += 1; @@ -3791,14 +4201,18 @@ uint32_t dot11f_unpack_ie_ese_txmit_power(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->power_limit = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->reserved = *pBuf; (void)pCtx; @@ -3819,8 +4233,10 @@ uint32_t dot11f_unpack_ie_ese_version(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->version = *pBuf; (void)pCtx; @@ -3904,26 +4320,34 @@ uint32_t dot11f_unpack_ie_fh_param_set(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->dwell_time, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->hop_set = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->hop_pattern = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->hop_index = *pBuf; (void)pCtx; @@ -3944,14 +4368,18 @@ uint32_t dot11f_unpack_ie_fh_params(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->radix = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->nchannels = *pBuf; (void)pCtx; @@ -3972,26 +4400,34 @@ uint32_t dot11f_unpack_ie_fh_patt_table(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->flag = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->nsets = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->modulus = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->offset = *pBuf; pBuf += 1; @@ -4041,28 +4477,36 @@ uint32_t dot11f_unpack_ie_ft_info(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &tmp41__, pBuf, 0); pBuf += 2; ielen -= 2; pDst->reserved = tmp41__ >> 0 & 0xff; pDst->IECount = tmp41__ >> 8 & 0xff; - if (unlikely(ielen < 16)) + if (unlikely(ielen < 16)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->MIC, pBuf, 16); pBuf += 16; ielen -= (uint8_t)16; - if (unlikely(ielen < 32)) + if (unlikely(ielen < 32)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->Anonce, pBuf, 32); pBuf += 32; ielen -= (uint8_t)32; - if (unlikely(ielen < 32)) + if (unlikely(ielen < 32)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->Snonce, pBuf, 32); pBuf += 32; @@ -4098,8 +4542,10 @@ uint32_t dot11f_unpack_ie_ht_caps(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &tmp42__, pBuf, 0); pBuf += 2; @@ -4118,8 +4564,10 @@ uint32_t dot11f_unpack_ie_ht_caps(tpAniSirGlobal pCtx, pDst->psmp = tmp42__ >> 13 & 0x1; pDst->stbcControlFrame = tmp42__ >> 14 & 0x1; pDst->lsigTXOPProtection = tmp42__ >> 15 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp43__ = *pBuf; pBuf += 1; @@ -4127,14 +4575,18 @@ uint32_t dot11f_unpack_ie_ht_caps(tpAniSirGlobal pCtx, pDst->maxRxAMPDUFactor = tmp43__ >> 0 & 0x3; pDst->mpduDensity = tmp43__ >> 2 & 0x7; pDst->reserved1 = tmp43__ >> 5 & 0x7; - if (unlikely(ielen < 16)) + if (unlikely(ielen < 16)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->supportedMCSSet, pBuf, 16); pBuf += 16; ielen -= (uint8_t)16; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &tmp44__, pBuf, 0); pBuf += 2; @@ -4144,8 +4596,10 @@ uint32_t dot11f_unpack_ie_ht_caps(tpAniSirGlobal pCtx, pDst->reserved2 = tmp44__ >> 3 & 0x1f; pDst->mcsFeedback = tmp44__ >> 8 & 0x3; pDst->reserved3 = tmp44__ >> 10 & 0x3f; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &tmp45__, pBuf, 0); pBuf += 4; @@ -4166,8 +4620,10 @@ uint32_t dot11f_unpack_ie_ht_caps(tpAniSirGlobal pCtx, pDst->uncompressedSteeringMatrixBFAntennae = tmp45__ >> 21 & 0x3; pDst->compressedSteeringMatrixBFAntennae = tmp45__ >> 23 & 0x3; pDst->reserved4 = tmp45__ >> 25 & 0x7f; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp46__ = *pBuf; pBuf += 1; @@ -4208,14 +4664,18 @@ uint32_t dot11f_unpack_ie_ht_info(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->primaryChannel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp47__ = *pBuf; pBuf += 1; @@ -4225,8 +4685,10 @@ uint32_t dot11f_unpack_ie_ht_info(tpAniSirGlobal pCtx, pDst->rifsMode = tmp47__ >> 3 & 0x1; pDst->controlledAccessOnly = tmp47__ >> 4 & 0x1; pDst->serviceIntervalGranularity = tmp47__ >> 5 & 0x7; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &tmp48__, pBuf, 0); pBuf += 2; @@ -4236,8 +4698,10 @@ uint32_t dot11f_unpack_ie_ht_info(tpAniSirGlobal pCtx, pDst->transmitBurstLimit = tmp48__ >> 3 & 0x1; pDst->obssNonHTStaPresent = tmp48__ >> 4 & 0x1; pDst->reserved = tmp48__ >> 5 & 0x7ff; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &tmp49__, pBuf, 0); pBuf += 2; @@ -4249,8 +4713,10 @@ uint32_t dot11f_unpack_ie_ht_info(tpAniSirGlobal pCtx, pDst->pcoActive = tmp49__ >> 10 & 0x1; pDst->pcoPhase = tmp49__ >> 11 & 0x1; pDst->reserved2 = tmp49__ >> 12 & 0xf; - if (unlikely(ielen < 16)) + if (unlikely(ielen < 16)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->basicMCSSet, pBuf, 16); pBuf += 16; @@ -4280,8 +4746,10 @@ uint32_t dot11f_unpack_ie_ibss_params(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->atim, pBuf, 0); (void)pCtx; @@ -4302,20 +4770,26 @@ uint32_t dot11f_unpack_ie_link_identifier(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->bssid, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->InitStaAddr, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->RespStaAddr, pBuf, 6); (void)pCtx; @@ -4415,14 +4889,18 @@ uint32_t dot11f_unpack_ie_measurement_report(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->token = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp50__ = *pBuf; pBuf += 1; @@ -4431,8 +4909,10 @@ uint32_t dot11f_unpack_ie_measurement_report(tpAniSirGlobal pCtx, pDst->incapable = tmp50__ >> 1 & 0x1; pDst->refused = tmp50__ >> 2 & 0x1; pDst->unused = tmp50__ >> 3 & 0x1f; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->type = *pBuf; pBuf += 1; @@ -4442,26 +4922,34 @@ uint32_t dot11f_unpack_ie_measurement_report(tpAniSirGlobal pCtx, } else { switch (pDst->type) { case 0: - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.Basic.channel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 8)) + if (unlikely(ielen < 8)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohq(pCtx, &pDst->report.Basic.meas_start_time, pBuf, 0); pBuf += 8; ielen -= (uint8_t)8; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->report.Basic.meas_duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp51__ = *pBuf; pBuf += 1; @@ -4474,158 +4962,208 @@ uint32_t dot11f_unpack_ie_measurement_report(tpAniSirGlobal pCtx, pDst->report.Basic.unused = tmp51__ >> 5 & 0x7; break; case 1: - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.CCA.channel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 8)) + if (unlikely(ielen < 8)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohq(pCtx, &pDst->report.CCA.meas_start_time, pBuf, 0); pBuf += 8; ielen -= (uint8_t)8; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->report.CCA.meas_duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.CCA.cca_busy_fraction = *pBuf; pBuf += 1; ielen -= (uint8_t)1; break; case 2: - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.RPIHistogram.channel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 8)) + if (unlikely(ielen < 8)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohq(pCtx, &pDst->report.RPIHistogram.meas_start_time, pBuf, 0); pBuf += 8; ielen -= (uint8_t)8; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->report.RPIHistogram.meas_duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.RPIHistogram.rpi0_density = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.RPIHistogram.rpi1_density = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.RPIHistogram.rpi2_density = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.RPIHistogram.rpi3_density = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.RPIHistogram.rpi4_density = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.RPIHistogram.rpi5_density = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.RPIHistogram.rpi6_density = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.RPIHistogram.rpi7_density = *pBuf; pBuf += 1; ielen -= (uint8_t)1; break; case 5: - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.Beacon.regClass = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.Beacon.channel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 8)) + if (unlikely(ielen < 8)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohq(pCtx, &pDst->report.Beacon.meas_start_time, pBuf, 0); pBuf += 8; ielen -= (uint8_t)8; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->report.Beacon.meas_duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp52__ = *pBuf; pBuf += 1; ielen -= 1; pDst->report.Beacon.condensed_PHY = tmp52__ >> 0 & 0x7f; pDst->report.Beacon.reported_frame_type = tmp52__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.Beacon.RCPI = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.Beacon.RSNI = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->report.Beacon.BSSID, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->report.Beacon.antenna_id = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->report.Beacon.parent_TSF, pBuf, 0); pBuf += 4; @@ -4729,14 +5267,18 @@ uint32_t dot11f_unpack_ie_measurement_request(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->measurement_token = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp53__ = *pBuf; pBuf += 1; @@ -4747,106 +5289,138 @@ uint32_t dot11f_unpack_ie_measurement_request(tpAniSirGlobal pCtx, pDst->report = tmp53__ >> 3 & 0x1; pDst->durationMandatory = tmp53__ >> 4 & 0x1; pDst->unused = tmp53__ >> 5 & 0x7; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->measurement_type = *pBuf; pBuf += 1; ielen -= (uint8_t)1; switch (pDst->measurement_type) { case 0: - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->measurement_request.Basic.channel_no = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 8)) + if (unlikely(ielen < 8)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->measurement_request.Basic.meas_start_time, pBuf, 8); pBuf += 8; ielen -= (uint8_t)8; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->measurement_request.Basic.meas_duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; break; case 1: - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->measurement_request.CCA.channel_no = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 8)) + if (unlikely(ielen < 8)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->measurement_request.CCA.meas_start_time, pBuf, 8); pBuf += 8; ielen -= (uint8_t)8; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->measurement_request.CCA.meas_duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; break; case 2: - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->measurement_request.RPIHistogram.channel_no = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 8)) + if (unlikely(ielen < 8)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->measurement_request.RPIHistogram.meas_start_time, pBuf, 8); pBuf += 8; ielen -= (uint8_t)8; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->measurement_request.RPIHistogram.meas_duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; break; case 5: - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->measurement_request.Beacon.regClass = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->measurement_request.Beacon.channel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->measurement_request.Beacon.randomization, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->measurement_request.Beacon.meas_duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->measurement_request.Beacon.meas_mode = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->measurement_request.Beacon.BSSID, pBuf, 6); pBuf += 6; @@ -4860,8 +5434,10 @@ uint32_t dot11f_unpack_ie_measurement_request(tpAniSirGlobal pCtx, sizeof(*pDst), append_ie); break; case 8: - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->measurement_request.lci.loc_subject = *pBuf; pBuf += 1; @@ -4875,14 +5451,18 @@ uint32_t dot11f_unpack_ie_measurement_request(tpAniSirGlobal pCtx, sizeof(*pDst), append_ie); break; case 16: - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->measurement_request.ftmrr.random_interval, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->measurement_request.ftmrr.min_ap_count = *pBuf; pBuf += 1; @@ -4915,14 +5495,18 @@ uint32_t dot11f_unpack_ie_mobility_domain(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->MDID, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp54__ = *pBuf; pDst->overDSCap = tmp54__ >> 0 & 0x1; @@ -4975,14 +5559,18 @@ uint32_t dot11f_unpack_ie_neighbor_report(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->bssid, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp55__ = *pBuf; pBuf += 1; @@ -4994,8 +5582,10 @@ uint32_t dot11f_unpack_ie_neighbor_report(tpAniSirGlobal pCtx, pDst->QosCap = tmp55__ >> 5 & 0x1; pDst->apsd = tmp55__ >> 6 & 0x1; pDst->rrm = tmp55__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp56__ = *pBuf; pBuf += 1; @@ -5004,26 +5594,34 @@ uint32_t dot11f_unpack_ie_neighbor_report(tpAniSirGlobal pCtx, pDst->ImmBA = tmp56__ >> 1 & 0x1; pDst->MobilityDomain = tmp56__ >> 2 & 0x1; pDst->reserved = tmp56__ >> 3 & 0x1f; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->reserved1, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->regulatoryClass = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->channel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->PhyType = *pBuf; pBuf += 1; @@ -5054,44 +5652,58 @@ uint32_t dot11f_unpack_ie_obss_scan_parameters(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->obssScanPassiveDwell, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->obssScanActiveDwell, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->bssChannelWidthTriggerScanInterval, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->obssScanPassiveTotalPerChannel, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->obssScanActiveTotalPerChannel, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->bssWidthChannelTransitionDelayFactor, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->obssScanActivityThreshold, pBuf, 0); (void)pCtx; @@ -5113,8 +5725,10 @@ uint32_t dot11f_unpack_ie_operating_mode(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp57__ = *pBuf; pDst->chanWidth = tmp57__ >> 0 & 0x3; @@ -5429,14 +6043,18 @@ uint32_t dot11f_unpack_ie_pti_control(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->tid = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->sequence_control, pBuf, 0); (void)pCtx; @@ -5458,8 +6076,10 @@ uint32_t dot11f_unpack_ie_pu_buffer_status(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp58__ = *pBuf; pDst->ac_bk_traffic_aval = tmp58__ >> 0 & 0x1; @@ -5485,14 +6105,18 @@ uint32_t dot11f_unpack_ie_power_caps(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->minTxPower = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->maxTxPower = *pBuf; (void)pCtx; @@ -5513,8 +6137,10 @@ uint32_t dot11f_unpack_ie_power_constraints(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->localPowerConstraints = *pBuf; (void)pCtx; @@ -5535,20 +6161,26 @@ uint32_t dot11f_unpack_ie_qbss_load(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->stacount, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->chautil = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->avail, pBuf, 0); (void)pCtx; @@ -5569,8 +6201,10 @@ uint32_t dot11f_unpack_ie_QCN_IE(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->version, pBuf, 4); (void)pCtx; @@ -5591,14 +6225,18 @@ uint32_t dot11f_unpack_ie_QComVendorIE(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->type = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->channel = *pBuf; (void)pCtx; @@ -5620,8 +6258,10 @@ uint32_t dot11f_unpack_ie_qos_caps_ap(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp59__ = *pBuf; pDst->count = tmp59__ >> 0 & 0xf; @@ -5648,8 +6288,10 @@ uint32_t dot11f_unpack_ie_qos_caps_station(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp60__ = *pBuf; pDst->acvo_uapsd = tmp60__ >> 0 & 0x1; @@ -5702,26 +6344,34 @@ uint32_t dot11f_unpack_ie_quiet(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->count = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->period = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->duration, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->offset, pBuf, 0); (void)pCtx; @@ -5742,8 +6392,10 @@ uint32_t dot11f_unpack_ie_rcpiie(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->rcpi = *pBuf; (void)pCtx; @@ -5843,8 +6495,10 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->version, pBuf, 0); pBuf += 2; @@ -5867,12 +6521,9 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, return 0U; } else { pDst->gp_cipher_suite_present = 1; - if (unlikely(ielen < 4)) - return DOT11F_INCOMPLETE_IE; - - if (ielen < 4) { + if (unlikely(ielen < 4)) { pDst->present = 0; - return DOT11F_SKIPPED_BAD_IE; + return DOT11F_INCOMPLETE_IE; } DOT11F_MEMCPY(pCtx, pDst->gp_cipher_suite, pBuf, 4); @@ -5890,20 +6541,19 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, pDst->pmkid_count = 0U; return 0U; } else { - if (unlikely(ielen < 2)) - return DOT11F_INCOMPLETE_IE; - - if (ielen < 2) { + if (unlikely(ielen < 2)) { pDst->present = 0; - return DOT11F_SKIPPED_BAD_IE; + return DOT11F_INCOMPLETE_IE; } framesntohs(pCtx, &pDst->pwise_cipher_suite_count, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; } - if (unlikely(ielen < pDst->pwise_cipher_suite_count * 4)) + if (unlikely(ielen < pDst->pwise_cipher_suite_count * 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } if (!pDst->pwise_cipher_suite_count || pDst->pwise_cipher_suite_count > 6) { @@ -5911,11 +6561,6 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, return DOT11F_SKIPPED_BAD_IE; } - if (ielen < pDst->pwise_cipher_suite_count * 4) { - pDst->present = 0; - return DOT11F_SKIPPED_BAD_IE; - } - DOT11F_MEMCPY(pCtx, pDst->pwise_cipher_suites, pBuf, (pDst->pwise_cipher_suite_count * 4)); pBuf += (pDst->pwise_cipher_suite_count * 4); ielen -= (pDst->pwise_cipher_suite_count * 4); @@ -5927,20 +6572,19 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, pDst->pmkid_count = 0U; return 0U; } else { - if (unlikely(ielen < 2)) - return DOT11F_INCOMPLETE_IE; - - if (ielen < 2) { + if (unlikely(ielen < 2)) { pDst->present = 0; - return DOT11F_SKIPPED_BAD_IE; + return DOT11F_INCOMPLETE_IE; } framesntohs(pCtx, &pDst->akm_suite_cnt, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; } - if (unlikely(ielen < pDst->akm_suite_cnt * 4)) + if (unlikely(ielen < pDst->akm_suite_cnt * 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } if (!pDst->akm_suite_cnt || pDst->akm_suite_cnt > 6) { @@ -5948,11 +6592,6 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, return DOT11F_SKIPPED_BAD_IE; } - if (ielen < pDst->akm_suite_cnt * 4) { - pDst->present = 0; - return DOT11F_SKIPPED_BAD_IE; - } - DOT11F_MEMCPY(pCtx, pDst->akm_suite, pBuf, (pDst->akm_suite_cnt * 4)); pBuf += (pDst->akm_suite_cnt * 4); ielen -= (pDst->akm_suite_cnt * 4); @@ -5963,12 +6602,9 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, return 0U; } else { pDst->RSN_Cap_present = 1; - if (unlikely(ielen < 2)) - return DOT11F_INCOMPLETE_IE; - - if (ielen < 2) { + if (unlikely(ielen < 2)) { pDst->present = 0; - return DOT11F_SKIPPED_BAD_IE; + return DOT11F_INCOMPLETE_IE; } DOT11F_MEMCPY(pCtx, pDst->RSN_Cap, pBuf, 2); @@ -5981,27 +6617,21 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, pDst->pmkid_count = 0U; return 0U; } else { - if (unlikely(ielen < 2)) - return DOT11F_INCOMPLETE_IE; - - if (ielen < 2) { + if (unlikely(ielen < 2)) { pDst->present = 0; - return DOT11F_SKIPPED_BAD_IE; + return DOT11F_INCOMPLETE_IE; } framesntohs(pCtx, &pDst->pmkid_count, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; } - if (unlikely(ielen < pDst->pmkid_count * 16)) - return DOT11F_INCOMPLETE_IE; - - if (pDst->pmkid_count > 4) { + if (unlikely(ielen < pDst->pmkid_count * 16)) { pDst->present = 0; - return DOT11F_SKIPPED_BAD_IE; + return DOT11F_INCOMPLETE_IE; } - if (ielen < pDst->pmkid_count * 16) { + if (pDst->pmkid_count > 4) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; } @@ -6013,12 +6643,9 @@ uint32_t dot11f_unpack_ie_rsn(tpAniSirGlobal pCtx, return 0U; } else { pDst->gp_mgmt_cipher_suite_present = 1; - if (unlikely(ielen < 4)) - return DOT11F_INCOMPLETE_IE; - - if (ielen < 4) { + if (unlikely(ielen < 4)) { pDst->present = 0; - return DOT11F_SKIPPED_BAD_IE; + return DOT11F_INCOMPLETE_IE; } DOT11F_MEMCPY(pCtx, pDst->gp_mgmt_cipher_suite, pBuf, 4); @@ -6041,8 +6668,10 @@ uint32_t dot11f_unpack_ie_rsniie(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->rsni = *pBuf; (void)pCtx; @@ -6171,20 +6800,26 @@ uint32_t dot11f_unpack_ie_tim(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->dtim_count = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->dtim_period = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->bmpctl = *pBuf; pBuf += 1; @@ -6214,14 +6849,18 @@ uint32_t dot11f_unpack_ie_tpc_report(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->tx_power = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->link_margin = *pBuf; (void)pCtx; @@ -6260,20 +6899,26 @@ uint32_t dot11f_unpack_ie_time_advertisement(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->timing_capabilities = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 10)) + if (unlikely(ielen < 10)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->time_value, pBuf, 10); pBuf += 10; ielen -= (uint8_t)10; - if (unlikely(ielen < 5)) + if (unlikely(ielen < 5)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->time_error, pBuf, 5); (void)pCtx; @@ -6294,14 +6939,18 @@ uint32_t dot11f_unpack_ie_timeout_interval(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->timeoutType = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &pDst->timeoutValue, pBuf, 0); (void)pCtx; @@ -6322,32 +6971,42 @@ uint32_t dot11f_unpack_ie_vht_ext_bss_load(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->muMIMOCapStaCount = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->ssUnderUtil = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->FortyMHzUtil = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->EightyMHzUtil = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->OneSixtyMHzUtil = *pBuf; (void)pCtx; @@ -6405,8 +7064,10 @@ uint32_t dot11f_unpack_ie_wapi(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->version, pBuf, 0); pBuf += 2; @@ -6415,14 +7076,18 @@ uint32_t dot11f_unpack_ie_wapi(tpAniSirGlobal pCtx, pDst->present = 0; return status | DOT11F_BAD_FIXED_VALUE; } - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->akm_suite_count, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < pDst->akm_suite_count * 4)) + if (unlikely(ielen < pDst->akm_suite_count * 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } if (pDst->akm_suite_count > 4) { pDst->present = 0; @@ -6432,14 +7097,18 @@ uint32_t dot11f_unpack_ie_wapi(tpAniSirGlobal pCtx, DOT11F_MEMCPY(pCtx, pDst->akm_suites, pBuf, (pDst->akm_suite_count * 4)); pBuf += (pDst->akm_suite_count * 4); ielen -= (pDst->akm_suite_count * 4); - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->unicast_cipher_suite_count, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < pDst->unicast_cipher_suite_count * 4)) + if (unlikely(ielen < pDst->unicast_cipher_suite_count * 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } if (pDst->unicast_cipher_suite_count > 4) { pDst->present = 0; @@ -6449,14 +7118,18 @@ uint32_t dot11f_unpack_ie_wapi(tpAniSirGlobal pCtx, DOT11F_MEMCPY(pCtx, pDst->unicast_cipher_suites, pBuf, (pDst->unicast_cipher_suite_count * 4)); pBuf += (pDst->unicast_cipher_suite_count * 4); ielen -= (pDst->unicast_cipher_suite_count * 4); - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->multicast_cipher_suite, pBuf, 4); pBuf += 4; ielen -= (uint8_t)4; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &tmp61__, pBuf, 0); pBuf += 2; @@ -6467,15 +7140,19 @@ uint32_t dot11f_unpack_ie_wapi(tpAniSirGlobal pCtx, pDst->bkid_count = 0U; return 0U; } else { - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->bkid_count, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; } - if (unlikely(ielen < pDst->bkid_count * 16)) + if (unlikely(ielen < pDst->bkid_count * 16)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } if (pDst->bkid_count > 4) { pDst->present = 0; @@ -6526,14 +7203,18 @@ uint32_t dot11f_unpack_ie_wfatpc(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->txPower = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->linkMargin = *pBuf; (void)pCtx; @@ -6580,8 +7261,10 @@ uint32_t dot11f_unpack_ie_wmm_caps(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->version = *pBuf; pBuf += 1; @@ -6590,8 +7273,10 @@ uint32_t dot11f_unpack_ie_wmm_caps(tpAniSirGlobal pCtx, pDst->present = 0; return status | DOT11F_BAD_FIXED_VALUE; } - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp62__ = *pBuf; pDst->reserved = tmp62__ >> 0 & 0xf; @@ -6618,14 +7303,18 @@ uint32_t dot11f_unpack_ie_wmm_info_ap(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->version = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp63__ = *pBuf; pDst->param_set_count = tmp63__ >> 0 & 0xf; @@ -6650,14 +7339,18 @@ uint32_t dot11f_unpack_ie_wmm_info_station(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->version = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp64__ = *pBuf; pDst->acvo_uapsd = tmp64__ >> 0 & 0x1; @@ -6693,8 +7386,10 @@ uint32_t dot11f_unpack_ie_wmm_params(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->version = *pBuf; pBuf += 1; @@ -6703,20 +7398,26 @@ uint32_t dot11f_unpack_ie_wmm_params(tpAniSirGlobal pCtx, pDst->present = 0; return status | DOT11F_BAD_FIXED_VALUE; } - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->qosInfo = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->reserved2 = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp65__ = *pBuf; pBuf += 1; @@ -6725,22 +7426,28 @@ uint32_t dot11f_unpack_ie_wmm_params(tpAniSirGlobal pCtx, pDst->acbe_acm = tmp65__ >> 4 & 0x1; pDst->acbe_aci = tmp65__ >> 5 & 0x3; pDst->unused1 = tmp65__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp66__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acbe_acwmin = tmp66__ >> 0 & 0xf; pDst->acbe_acwmax = tmp66__ >> 4 & 0xf; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->acbe_txoplimit, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp67__ = *pBuf; pBuf += 1; @@ -6749,22 +7456,28 @@ uint32_t dot11f_unpack_ie_wmm_params(tpAniSirGlobal pCtx, pDst->acbk_acm = tmp67__ >> 4 & 0x1; pDst->acbk_aci = tmp67__ >> 5 & 0x3; pDst->unused2 = tmp67__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp68__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acbk_acwmin = tmp68__ >> 0 & 0xf; pDst->acbk_acwmax = tmp68__ >> 4 & 0xf; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->acbk_txoplimit, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp69__ = *pBuf; pBuf += 1; @@ -6773,22 +7486,28 @@ uint32_t dot11f_unpack_ie_wmm_params(tpAniSirGlobal pCtx, pDst->acvi_acm = tmp69__ >> 4 & 0x1; pDst->acvi_aci = tmp69__ >> 5 & 0x3; pDst->unused3 = tmp69__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp70__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acvi_acwmin = tmp70__ >> 0 & 0xf; pDst->acvi_acwmax = tmp70__ >> 4 & 0xf; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->acvi_txoplimit, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp71__ = *pBuf; pBuf += 1; @@ -6797,16 +7516,20 @@ uint32_t dot11f_unpack_ie_wmm_params(tpAniSirGlobal pCtx, pDst->acvo_acm = tmp71__ >> 4 & 0x1; pDst->acvo_aci = tmp71__ >> 5 & 0x3; pDst->unused4 = tmp71__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp72__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acvo_acwmin = tmp72__ >> 0 & 0xf; pDst->acvo_acwmax = tmp72__ >> 4 & 0xf; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->acvo_txoplimit, pBuf, 0); (void)pCtx; @@ -6827,8 +7550,10 @@ uint32_t dot11f_unpack_ie_wpa(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->version, pBuf, 0); pBuf += 2; @@ -6844,8 +7569,10 @@ uint32_t dot11f_unpack_ie_wpa(tpAniSirGlobal pCtx, return 0U; } else { pDst->multicast_cipher_present = 1U; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->multicast_cipher, pBuf, 4); pBuf += 4; @@ -6856,15 +7583,19 @@ uint32_t dot11f_unpack_ie_wpa(tpAniSirGlobal pCtx, pDst->auth_suite_count = 0U; return 0U; } else { - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->unicast_cipher_count, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; } - if (unlikely(ielen < pDst->unicast_cipher_count * 4)) + if (unlikely(ielen < pDst->unicast_cipher_count * 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } if (pDst->unicast_cipher_count > 4) { pDst->present = 0; @@ -6878,15 +7609,19 @@ uint32_t dot11f_unpack_ie_wpa(tpAniSirGlobal pCtx, pDst->auth_suite_count = 0U; return 0U; } else { - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->auth_suite_count, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; } - if (unlikely(ielen < pDst->auth_suite_count * 4)) + if (unlikely(ielen < pDst->auth_suite_count * 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } if (pDst->auth_suite_count > 4) { pDst->present = 0; @@ -6899,8 +7634,10 @@ uint32_t dot11f_unpack_ie_wpa(tpAniSirGlobal pCtx, if (!ielen) { return 0U; } else { - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->caps, pBuf, 0); } @@ -7442,8 +8179,10 @@ uint32_t dot11f_unpack_ie_addba_extn_element(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp73__ = *pBuf; pDst->no_fragmentation = tmp73__ >> 0 & 0x1; @@ -7468,14 +8207,18 @@ uint32_t dot11f_unpack_ie_bss_color_change(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->countdown = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp74__ = *pBuf; pDst->new_color = tmp74__ >> 0 & 0x3f; @@ -7498,8 +8241,10 @@ uint32_t dot11f_unpack_ie_dh_parameter_element(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->group, pBuf, 2); pBuf += 2; @@ -7549,26 +8294,34 @@ uint32_t dot11f_unpack_ie_ext_chan_switch_ann(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->switch_mode = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->new_reg_class = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->new_channel = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->switch_count = *pBuf; (void)pCtx; @@ -7589,8 +8342,10 @@ uint32_t dot11f_unpack_ie_fils_assoc_delay_info(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->assoc_delay_info = *pBuf; (void)pCtx; @@ -7611,14 +8366,18 @@ uint32_t dot11f_unpack_ie_fils_hlp_container(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->dest_mac, pBuf, 6); pBuf += 6; ielen -= (uint8_t)6; - if (unlikely(ielen < 6)) + if (unlikely(ielen < 6)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->src_mac, pBuf, 6); pBuf += 6; @@ -7644,8 +8403,10 @@ uint32_t dot11f_unpack_ie_fils_indication(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &tmp75__, pBuf, 0); pBuf += 2; @@ -7679,8 +8440,10 @@ uint32_t dot11f_unpack_ie_fils_kde(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 8)) + if (unlikely(ielen < 8)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->key_rsc, pBuf, 8); pBuf += 8; @@ -7725,8 +8488,10 @@ uint32_t dot11f_unpack_ie_fils_nonce(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 16)) + if (unlikely(ielen < 16)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->nonce, pBuf, 16); (void)pCtx; @@ -7747,8 +8512,10 @@ uint32_t dot11f_unpack_ie_fils_public_key(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->key_type = *pBuf; pBuf += 1; @@ -7773,8 +8540,10 @@ uint32_t dot11f_unpack_ie_fils_session(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 8)) + if (unlikely(ielen < 8)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->session, pBuf, 8); (void)pCtx; @@ -7840,8 +8609,10 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &tmp76__, pBuf, 0); pBuf += 4; @@ -7869,8 +8640,10 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, pDst->amsdu_frag = tmp76__ >> 29 & 0x1; pDst->flex_twt_sched = tmp76__ >> 30 & 0x1; pDst->rx_ctrl_frame = tmp76__ >> 31 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp77__ = *pBuf; pBuf += 1; @@ -7883,8 +8656,10 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, pDst->ops_supp = tmp77__ >> 5 & 0x1; pDst->amsdu_in_ampdu = tmp77__ >> 6 & 0x1; pDst->reserved1 = tmp77__ >> 7 & 0x1; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &tmp78__, pBuf, 0); pBuf += 4; @@ -7911,8 +8686,10 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, pDst->dcm_enc_rx = tmp78__ >> 27 & 0x7; pDst->ul_he_mu = tmp78__ >> 30 & 0x1; pDst->su_beamformer = tmp78__ >> 31 & 0x1; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &tmp79__, pBuf, 0); pBuf += 4; @@ -7937,8 +8714,10 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, pDst->max_nc = tmp79__ >> 27 & 0x7; pDst->tx_stbc_gt_80mhz = tmp79__ >> 30 & 0x1; pDst->rx_stbc_gt_80mhz = tmp79__ >> 31 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp80__ = *pBuf; pBuf += 1; @@ -7950,20 +8729,26 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, pDst->er_1x_he_ltf_gi = tmp80__ >> 4 & 0x1; pDst->midamble_rx_1x_he_ltf = tmp80__ >> 5 & 0x1; pDst->reserved2 = tmp80__ >> 6 & 0x3; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->rx_he_mcs_map_lt_80, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->tx_he_mcs_map_lt_80, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; - if (unlikely(ielen < pDst->chan_width_2 * 2)) + if (unlikely(ielen < pDst->chan_width_2 * 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } if (pDst->chan_width_2 > 1) { pDst->present = 0; @@ -7973,8 +8758,10 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, DOT11F_MEMCPY(pCtx, pDst->rx_he_mcs_map_160, pBuf, (pDst->chan_width_2 * 2)); pBuf += (pDst->chan_width_2 * 2); ielen -= (pDst->chan_width_2 * 2); - if (unlikely(ielen < pDst->chan_width_2 * 2)) + if (unlikely(ielen < pDst->chan_width_2 * 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } if (pDst->chan_width_2 > 1) { pDst->present = 0; @@ -7984,8 +8771,10 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, DOT11F_MEMCPY(pCtx, pDst->tx_he_mcs_map_160, pBuf, (pDst->chan_width_2 * 2)); pBuf += (pDst->chan_width_2 * 2); ielen -= (pDst->chan_width_2 * 2); - if (unlikely(ielen < pDst->chan_width_3 * 2)) + if (unlikely(ielen < pDst->chan_width_3 * 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } if (pDst->chan_width_3 > 1) { pDst->present = 0; @@ -7995,8 +8784,10 @@ uint32_t dot11f_unpack_ie_he_cap(tpAniSirGlobal pCtx, DOT11F_MEMCPY(pCtx, pDst->rx_he_mcs_map_80_80, pBuf, (pDst->chan_width_3 * 2)); pBuf += (pDst->chan_width_3 * 2); ielen -= (pDst->chan_width_3 * 2); - if (unlikely(ielen < pDst->chan_width_3 * 2)) + if (unlikely(ielen < pDst->chan_width_3 * 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } if (pDst->chan_width_3 > 1) { pDst->present = 0; @@ -8038,8 +8829,10 @@ uint32_t dot11f_unpack_ie_he_op(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 4)) + if (unlikely(ielen < 4)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohl(pCtx, &tmp81__, pBuf, 0); pBuf += 4; @@ -8055,28 +8848,36 @@ uint32_t dot11f_unpack_ie_he_op(tpAniSirGlobal pCtx, pDst->tx_bssid_ind = tmp81__ >> 29 & 0x1; pDst->bss_col_disabled = tmp81__ >> 30 & 0x1; pDst->reserved2 = tmp81__ >> 31 & 0x1; - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } DOT11F_MEMCPY(pCtx, pDst->basic_mcs_nss, pBuf, 2); pBuf += 2; ielen -= (uint8_t)2; switch (pDst->vht_oper_present) { case 1: - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->vht_oper.info.chan_width = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->vht_oper.info.center_freq_seg0 = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->vht_oper.info.center_freq_seg1 = *pBuf; pBuf += 1; @@ -8085,8 +8886,10 @@ uint32_t dot11f_unpack_ie_he_op(tpAniSirGlobal pCtx, } switch (pDst->mbssid_ap) { case 1: - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->maxbssid_ind.info.data = *pBuf; pBuf += 1; @@ -8112,8 +8915,10 @@ uint32_t dot11f_unpack_ie_hs20vendor_ie(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp82__ = *pBuf; pBuf += 1; @@ -8127,16 +8932,20 @@ uint32_t dot11f_unpack_ie_hs20vendor_ie(tpAniSirGlobal pCtx, } else { switch (pDst->hs_id_present) { case 1: - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->hs_id.pps_mo.pps_mo_id, pBuf, 0); pBuf += 2; ielen -= (uint8_t)2; break; case 2: - if (unlikely(ielen < 2)) + if (unlikely(ielen < 2)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } framesntohs(pCtx, &pDst->hs_id.anqp_domain.anqp_domain_id, pBuf, 0); pBuf += 2; @@ -8163,8 +8972,10 @@ uint32_t dot11f_unpack_ie_ht2040_bss_coexistence(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp83__ = *pBuf; pDst->info_request = tmp83__ >> 0 & 0x1; @@ -8191,8 +9002,10 @@ uint32_t dot11f_unpack_ie_ht2040_bss_intolerant_report(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->operating_class = *pBuf; pBuf += 1; @@ -8230,14 +9043,18 @@ uint32_t dot11f_unpack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->qos = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp84__ = *pBuf; pBuf += 1; @@ -8246,22 +9063,28 @@ uint32_t dot11f_unpack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, pDst->acbe_acm = tmp84__ >> 4 & 0x1; pDst->acbe_aci = tmp84__ >> 5 & 0x3; pDst->unused1 = tmp84__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp85__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acbe_acwmin = tmp85__ >> 0 & 0xf; pDst->acbe_acwmax = tmp85__ >> 4 & 0xf; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->acbe_muedca_timer = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp86__ = *pBuf; pBuf += 1; @@ -8270,22 +9093,28 @@ uint32_t dot11f_unpack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, pDst->acbk_acm = tmp86__ >> 4 & 0x1; pDst->acbk_aci = tmp86__ >> 5 & 0x3; pDst->unused2 = tmp86__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp87__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acbk_acwmin = tmp87__ >> 0 & 0xf; pDst->acbk_acwmax = tmp87__ >> 4 & 0xf; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->acbk_muedca_timer = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp88__ = *pBuf; pBuf += 1; @@ -8294,22 +9123,28 @@ uint32_t dot11f_unpack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, pDst->acvi_acm = tmp88__ >> 4 & 0x1; pDst->acvi_aci = tmp88__ >> 5 & 0x3; pDst->unused3 = tmp88__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp89__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acvi_acwmin = tmp89__ >> 0 & 0xf; pDst->acvi_acwmax = tmp89__ >> 4 & 0xf; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->acvi_muedca_timer = *pBuf; pBuf += 1; ielen -= (uint8_t)1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp90__ = *pBuf; pBuf += 1; @@ -8318,16 +9153,20 @@ uint32_t dot11f_unpack_ie_mu_edca_param_set(tpAniSirGlobal pCtx, pDst->acvo_acm = tmp90__ >> 4 & 0x1; pDst->acvo_aci = tmp90__ >> 5 & 0x3; pDst->unused4 = tmp90__ >> 7 & 0x1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } tmp91__ = *pBuf; pBuf += 1; ielen -= 1; pDst->acvo_acwmin = tmp91__ >> 0 & 0xf; pDst->acvo_acwmax = tmp91__ >> 4 & 0xf; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->acvo_muedca_timer = *pBuf; (void)pCtx; @@ -8368,8 +9207,10 @@ uint32_t dot11f_unpack_ie_sec_chan_offset_ele(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->secondaryChannelOffset = *pBuf; (void)pCtx; @@ -8405,8 +9246,10 @@ uint32_t dot11f_unpack_ie_vendor_vht_ie(tpAniSirGlobal pCtx, if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; - if (unlikely(ielen < 1)) + if (unlikely(ielen < 1)) { + pDst->present = 0; return DOT11F_INCOMPLETE_IE; + } pDst->sub_type = *pBuf; pBuf += 1;