jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

WFD: Use cleaner bounds checking for sub-element length field

Browse source 
Mark the variable as unsigned and make the length check use "len > end -
pos" version to makes this easier to understand for static analyzers
(CID 74155).

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2014-10-11 18:40:32 +03:00
parent c061ae590a
commit 4debeb42a6
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
wpa_supplicant/wifi_display.c
View file

@ -271,7 +271,7 @@ int wifi_display_subelem_set_from_ies(struct wpa_global *global,
{
int subelements[MAX_WFD_SUBELEMS] = {};
const u8 *pos, *end;
int len, subelem;
unsigned int len, subelem;
struct wpabuf *e;
wpa_printf(MSG_DEBUG, "WFD IEs set: %p - %lu",
@ -292,7 +292,7 @@ int wifi_display_subelem_set_from_ies(struct wpa_global *global,
wpa_printf(MSG_DEBUG, "WFD Sub-Element ID %d - len %d",
*pos, len - 3);
if (pos + len > end)
if (len > end - pos)
break;
subelem = *pos;