A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 16:46:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Skip an IE if found more its max times in a frame

Browse source 
Check if a IE has been encountered more than max possible for that IE
while parsing a frame.

Change-Id: I1054c7df18780469849be55fc4343f09ac502a49
CRs-Fixed: 2058261
This commit is contained in:
Naveen Rawat 2017-06-09 14:25:45 -07:00 • committed by snandini
commit 9ff3e249af
2 changed files with 16 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

4
core/mac/src/include/dot11f.h
View file

@ -35,7 +35,7 @@
*
*
* This file was automatically generated by 'framesc'
* Tue May 30 15:11:12 2017 from the following file(s):
* Fri Jun 9 14:23:47 2017 from the following file(s):
*
* dot11f.frms
*
@ -88,8 +88,8 @@ typedef uint32_t tDOT11F_U64[2];
#define DOT11F_BUFFER_OVERFLOW (0x10000005)
#define DOT11F_MANDATORY_TLV_MISSING (0x00001000)
#define DOT11F_FAILED(code) ((code) & 0x10000000)
#define DOT11F_WARNED(code) (((0 == (code)) & 0x10000000) && code)
#define DOT11F_SUCCEEDED(code) ((code) == 0)
#define DOT11F_WARNED(code) (!DOT11F_SUCCEEDED(code) && !DOT11F_FAILED(code))
/*********************************************************************
* Fixed Fields *

27
core/mac/src/sys/legacy/src/utils/src/dot11f.c
View file

@ -33,7 +33,7 @@
*
*
* This file was automatically generated by 'framesc'
* Tue May 30 15:11:12 2017 from the following file(s):
* Fri Jun 9 14:23:47 2017 from the following file(s):
*
* dot11f.frms
*
@ -10316,6 +10316,10 @@ static uint32_t unpack_core(tpAniSirGlobal pCtx,
countOffset = ((0 != pIe->arraybound) *
(*(uint16_t *)(pFrm + pIe->countOffset)));
if (0 != pIe->arraybound && countOffset >= pIe->arraybound) {
status |= DOT11F_DUPLICATE_IE;
goto skip_dup_ie;
}
switch (pIe->sig) {
case SigIeGTK:
status |=
@ -10978,18 +10982,14 @@ static uint32_t unpack_core(tpAniSirGlobal pCtx,
append_ie);
break;
case SigIeNeighborReport:
if (countOffset < MAX_SUPPORTED_NEIGHBOR_RPT) {
status |=
dot11f_unpack_ie_neighbor_report(
pCtx, pBufRemaining, len,
(tDot11fIENeighborReport *)
(pFrm + pIe->offset +
sizeof(tDot11fIENeighborReport) *
countOffset),
append_ie);
} else {
status |= DOT11F_BUFFER_OVERFLOW;
}
status |=
dot11f_unpack_ie_neighbor_report(
pCtx, pBufRemaining, len,
(tDot11fIENeighborReport *)
(pFrm + pIe->offset +
sizeof(tDot11fIENeighborReport) *
countOffset),
append_ie);
break;
case SigIeOBSSScanParameters:
status |=
@ -11780,6 +11780,7 @@ static uint32_t unpack_core(tpAniSirGlobal pCtx,
status |= DOT11F_UNKNOWN_IES;
}
skip_dup_ie:
pBufRemaining += len;
if (len > nBufRemaining) {