From c061ae590aec1765e660fa9dc00cbcb5479f5b3e Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sat, 11 Oct 2014 18:34:25 +0300 Subject: [PATCH] P2P NFC: Make code easier for static analyzers len + pos > end comparison here did verify that the length field had a valid value, but that did not seem to enough to avoid TAINTED_SCALAR warning. Re-order that validation step to be equivalent "len > end - pos" to remove these false positives (CID 68116). Signed-off-by: Jouni Malinen --- wpa_supplicant/p2p_supplicant.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/wpa_supplicant/p2p_supplicant.c b/wpa_supplicant/p2p_supplicant.c index 1b6919d0c..2aaee1fa3 100644 --- a/wpa_supplicant/p2p_supplicant.c +++ b/wpa_supplicant/p2p_supplicant.c @@ -7602,7 +7602,7 @@ static int wpas_p2p_nfc_connection_handover(struct wpa_supplicant *wpa_s, } len = WPA_GET_BE16(pos); pos += 2; - if (pos + len > end) { + if (len > end - pos) { wpa_printf(MSG_DEBUG, "P2P: Not enough data for WSC " "attributes"); return -1; @@ -7618,7 +7618,7 @@ static int wpas_p2p_nfc_connection_handover(struct wpa_supplicant *wpa_s, } len = WPA_GET_BE16(pos); pos += 2; - if (pos + len > end) { + if (len > end - pos) { wpa_printf(MSG_DEBUG, "P2P: Not enough data for P2P " "attributes"); return -1;