From d84416a2af92b7f60089f04670691372c4f5fea2 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sat, 6 Dec 2014 18:51:23 +0200 Subject: [PATCH] Interworking: Make bounds checking easier for static analyzers 'num * 5 > end - pos' handles bounds checking a bit more efficiently, but apparently that is not clear enough for all static analyzers. Replace with 'num > left / 5' to avoid false reports. (CID 68117) Signed-off-by: Jouni Malinen --- wpa_supplicant/interworking.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/wpa_supplicant/interworking.c b/wpa_supplicant/interworking.c index a22c8634f..8c4ea3468 100644 --- a/wpa_supplicant/interworking.c +++ b/wpa_supplicant/interworking.c @@ -508,20 +508,25 @@ static struct nai_realm * nai_realm_parse(struct wpabuf *anqp, u16 *count) struct nai_realm *realm; const u8 *pos, *end; u16 i, num; + size_t left; - if (anqp == NULL || wpabuf_len(anqp) < 2) + if (anqp == NULL) + return NULL; + left = wpabuf_len(anqp); + if (left < 2) return NULL; pos = wpabuf_head_u8(anqp); - end = pos + wpabuf_len(anqp); + end = pos + left; num = WPA_GET_LE16(pos); wpa_printf(MSG_DEBUG, "NAI Realm Count: %u", num); pos += 2; + left -= 2; - if (num * 5 > end - pos) { + if (num > left / 5) { wpa_printf(MSG_DEBUG, "Invalid NAI Realm Count %u - not " "enough data (%u octets) for that many realms", - num, (unsigned int) (end - pos)); + num, (unsigned int) left); return NULL; }