From f3cc07311ae60b336a2e590dc44250ea725b8265 Mon Sep 17 00:00:00 2001 From: Abhishek Singh Date: Wed, 26 Jul 2017 14:40:04 +0530 Subject: [PATCH] qcacld-3.0: Fix TLV length check issue in unpack tlv In unpack tlv, length of tag and length fields are not considered while checking for min length for the tag, this result into failure in unpacking the TLV. Fix it by including length of tag and length fields while checking for min length. Change-Id: Icf06b935a883e41426f5fcd1668ad8461b58349f CRs-Fixed: 2070452 --- core/mac/src/sys/legacy/src/utils/src/dot11f.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/mac/src/sys/legacy/src/utils/src/dot11f.c b/core/mac/src/sys/legacy/src/utils/src/dot11f.c index a6051e5c3959..5acb9367c99f 100644 --- a/core/mac/src/sys/legacy/src/utils/src/dot11f.c +++ b/core/mac/src/sys/legacy/src/utils/src/dot11f.c @@ -33,7 +33,7 @@ * * * This file was automatically generated by 'framesc' - * Fri Jul 14 12:29:59 2017 from the following file(s): + * Wed Jul 26 14:38:34 2017 from the following file(s): * * dot11f.frms * @@ -12111,7 +12111,7 @@ static uint32_t unpack_tlv_core(tpAniSirGlobal pCtx, /* Now, *if* we found a hit... */ if (pTlv) { - if (len < pTlv->minSize - npec) { + if (len + (pTlv->sType + pTlv->sLen) < pTlv->minSize - npec) { FRAMES_LOG3(pCtx, FRLOGW, FRFL("The IE %s must be " "at least %d bytes in size, but the size is only " "%d bytes.\n"),