From 01d01a311c52d56709eaadc5ffbbe7a7d773b041 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sat, 23 Feb 2019 12:49:17 +0200 Subject: [PATCH] UBSan: Avoid size_t variable overflow in control interface The loop "if (i-- == 0) break" style construction works in practice fine since the check against 0 is done before decrementation. However, this hits an UBSan warning, so split that decrementation to happen as a separate step after the check and break from the loop. ctrl_iface.c:5086:9: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'size_t' (aka 'unsigned long') Signed-off-by: Jouni Malinen --- wpa_supplicant/ctrl_iface.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c index 80f2d080e..013d05cb3 100644 --- a/wpa_supplicant/ctrl_iface.c +++ b/wpa_supplicant/ctrl_iface.c @@ -5083,10 +5083,11 @@ static int wpa_supplicant_ctrl_iface_bss(struct wpa_supplicant *wpa_s, bss = NULL; dl_list_for_each(tmp, &wpa_s->bss_id, struct wpa_bss, list_id) { - if (i-- == 0) { + if (i == 0) { bss = tmp; break; } + i--; } }