From 9ff3e249afedc168d5292dfc981d8509ee3f390d Mon Sep 17 00:00:00 2001
From: Naveen Rawat <naveenrawat@codeaurora.org>
Date: Fri, 9 Jun 2017 14:25:45 -0700
Subject: [PATCH] qcacld-3.0: Skip an IE if found more its max times in a frame

Check if a IE has been encountered more than max possible for that IE
while parsing a frame.

Change-Id: I1054c7df18780469849be55fc4343f09ac502a49
CRs-Fixed: 2058261
---
 core/mac/src/include/dot11f.h                 |  4 +--
 .../mac/src/sys/legacy/src/utils/src/dot11f.c | 27 ++++++++++---------
 2 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/core/mac/src/include/dot11f.h b/core/mac/src/include/dot11f.h
index d8da91d04c66..5b13dba8fec7 100644
--- a/core/mac/src/include/dot11f.h
+++ b/core/mac/src/include/dot11f.h
@@ -35,7 +35,7 @@
  *
  *
  * This file was automatically generated by 'framesc'
- * Tue May 30 15:11:12 2017 from the following file(s):
+ * Fri Jun  9 14:23:47 2017 from the following file(s):
  *
  * dot11f.frms
  *
@@ -88,8 +88,8 @@ typedef uint32_t tDOT11F_U64[2];
 #define DOT11F_BUFFER_OVERFLOW       (0x10000005)
 #define DOT11F_MANDATORY_TLV_MISSING (0x00001000)
 #define DOT11F_FAILED(code)          ((code) & 0x10000000)
-#define DOT11F_WARNED(code)          (((0 == (code)) & 0x10000000) && code)
 #define DOT11F_SUCCEEDED(code)       ((code) == 0)
+#define DOT11F_WARNED(code)          (!DOT11F_SUCCEEDED(code) && !DOT11F_FAILED(code))
 
 /*********************************************************************
  * Fixed Fields                                                      *
diff --git a/core/mac/src/sys/legacy/src/utils/src/dot11f.c b/core/mac/src/sys/legacy/src/utils/src/dot11f.c
index 972bfeb28027..0978d5a66200 100644
--- a/core/mac/src/sys/legacy/src/utils/src/dot11f.c
+++ b/core/mac/src/sys/legacy/src/utils/src/dot11f.c
@@ -33,7 +33,7 @@
  *
  *
  * This file was automatically generated by 'framesc'
- * Tue May 30 15:11:12 2017 from the following file(s):
+ * Fri Jun  9 14:23:47 2017 from the following file(s):
  *
  * dot11f.frms
  *
@@ -10316,6 +10316,10 @@ static uint32_t unpack_core(tpAniSirGlobal pCtx,
 
 				countOffset = ((0 != pIe->arraybound) *
 						(*(uint16_t *)(pFrm + pIe->countOffset)));
+				if (0 != pIe->arraybound && countOffset >= pIe->arraybound) {
+					status |= DOT11F_DUPLICATE_IE;
+					goto skip_dup_ie;
+				}
 				switch (pIe->sig) {
 				case SigIeGTK:
 					status |=
@@ -10978,18 +10982,14 @@ static uint32_t unpack_core(tpAniSirGlobal pCtx,
 						    append_ie);
 					break;
 				case SigIeNeighborReport:
-					if (countOffset < MAX_SUPPORTED_NEIGHBOR_RPT) {
-						status |=
-							dot11f_unpack_ie_neighbor_report(
-							    pCtx, pBufRemaining, len,
-							    (tDot11fIENeighborReport *)
-							    (pFrm + pIe->offset +
-							    sizeof(tDot11fIENeighborReport) *
-							    countOffset),
-							    append_ie);
-					} else {
-						status |= DOT11F_BUFFER_OVERFLOW;
-					}
+					status |=
+						dot11f_unpack_ie_neighbor_report(
+						    pCtx, pBufRemaining, len,
+						    (tDot11fIENeighborReport *)
+						    (pFrm + pIe->offset +
+						    sizeof(tDot11fIENeighborReport) *
+						    countOffset),
+						    append_ie);
 					break;
 				case SigIeOBSSScanParameters:
 					status |=
@@ -11780,6 +11780,7 @@ static uint32_t unpack_core(tpAniSirGlobal pCtx,
 			status |= DOT11F_UNKNOWN_IES;
 		}
 
+skip_dup_ie:
 		pBufRemaining += len;
 
 		if (len > nBufRemaining) {