Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

qcacld-2.0: Fix integer truncation in ConvertWscOpaque 

In the function ConvertWscOpaque, driver does copy of the
new parameters present in the additional IEs of the upstream
assoc request frame. While copy of the IE length pOld->length to
curAddIELen, possible integer truncation could occur, as the
curAddIELen is of the type tANI_U8 whereas pOld->length is of
type tANI_U16.

Change the data type of curAddIELen to tANI_U16. Make changes in
ConvertP2POpaque and ConvertWFDOpaque as well.

Change-Id: Ic26660fca4a02a265bfc9553b066c7ee42f1d1f4
CRs-Fixed: 2528392
This commit is contained in:
Will Huang 2019-09-17 09:29:34 +08:00 committed by L R
parent f338634bcc
commit 92db492a76
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/net/wireless/qcacld-2.0/CORE/SYS/legacy/src/utils/src/utilsParser.c
View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 2011-2015, 2017 The Linux Foundation. All rights reserved.
* Copyright (c) 2011-2015,2017,2019 The Linux Foundation. All rights reserved.
*
* Previously licensed under the ISC license by Qualcomm Atheros, Inc.
*
@ -151,7 +151,7 @@ tSirRetStatus ConvertWscOpaque( tpAniSirGlobal pMac,
{
// This is awful, I know, but the old code just rammed the IE into
// an opaque array. Note that we need to explicitly add the vendorIE and OUI !
tANI_U8 curAddIELen = pOld->length;
tANI_U16 curAddIELen = pOld->length;
pOld->length = curAddIELen + pNew->num_data + 6;
pOld->addIEdata[ curAddIELen++ ] = 0xdd;
@ -171,7 +171,7 @@ tSirRetStatus ConvertP2POpaque( tpAniSirGlobal pMac,
{
// This is awful, I know, but the old code just rammed the IE into
// an opaque array. Note that we need to explicitly add the vendorIE and OUI !
tANI_U8 curAddIELen = pOld->length;
tANI_U16 curAddIELen = pOld->length;
pOld->length = curAddIELen + pNew->num_data + 6;
pOld->addIEdata[ curAddIELen++ ] = 0xdd;
@ -192,7 +192,7 @@ tSirRetStatus ConvertWFDOpaque( tpAniSirGlobal pMac,
{
// This is awful, I know, but the old code just rammed the IE into
// an opaque array. Note that we need to explicitly add the vendorIE and OUI !
tANI_U8 curAddIELen = pOld->length;
tANI_U16 curAddIELen = pOld->length;
pOld->length = curAddIELen + pNew->num_data + 6;
pOld->addIEdata[ curAddIELen++ ] = 0xdd;