Merge "qcacld-3.0: Fix possible OOB in unpack_tlv_core" (64b340a5) · Commits · e / devices / android_kernel_fairphone_FP5

core/mac/src/include/dot11f.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -26,7 +26,7 @@
		*
		*
		* This file was automatically generated by 'framesc'
		* Mon Jul 19 14:21:41 2021 from the following file(s):
		* Wed Sep 29 13:23:21 2021 from the following file(s):
		*
		* dot11f.frms
		*

+12 −6

Original line number	Diff line number	Diff line
		@@ -24,7 +24,7 @@
		*
		*
		* This file was automatically generated by 'framesc'
		* Mon Jul 19 14:21:41 2021 from the following file(s):
		* Wed Sep 29 13:23:21 2021 from the following file(s):
		*
		* dot11f.frms
		*
		@@ -15186,7 +15186,6 @@ static uint32_t unpack_tlv_core(tpAniSirGlobal pCtx,
		}
		/* & length, */
		if (pTlv->sLen == 2) {
		framesntohs(pCtx, &len, pBufRemaining, pTlv->fMsb);
		if (2 > nBufRemaining) {
		FRAMES_LOG0(pCtx, FRLOGE, FRFL("This frame reports "
		"fewer two byte(s) remaining.\n"));
		@@ -15194,6 +15193,7 @@ static uint32_t unpack_tlv_core(tpAniSirGlobal pCtx,
		FRAMES_DBG_BREAK();
		goto MandatoryCheck;
		}
		framesntohs(pCtx, &len, pBufRemaining, pTlv->fMsb);
		pBufRemaining += 2;
		nBufRemaining -= 2;
		} else {
		@@ -15202,9 +15202,14 @@ static uint32_t unpack_tlv_core(tpAniSirGlobal pCtx,
		nBufRemaining -= 1;
		}
		} else {
		if (TLVs[0].sType > nBufRemaining) {
		FRAMES_LOG0(pCtx, FRLOGE, FRFL("This frame reports "
		"fewer LVs[0].sType byte(s) remaining.\n"));
		status \|= DOT11F_INCOMPLETE_TLV;
		goto MandatoryCheck;
		}
		pBufRemaining += TLVs[0].sType;
		nBufRemaining -= TLVs[0].sType;
		framesntohs(pCtx, &len, pBufRemaining, (TLVs[0].sType == 2));
		if (2 > nBufRemaining) {
		FRAMES_LOG0(pCtx, FRLOGE, FRFL("This frame reports "
		"fewer two byte(s) remaining.\n"));
		@@ -15212,6 +15217,7 @@ static uint32_t unpack_tlv_core(tpAniSirGlobal pCtx,
		FRAMES_DBG_BREAK();
		goto MandatoryCheck;
		}
		framesntohs(pCtx, &len, pBufRemaining, (TLVs[0].sType == 2));
		pBufRemaining += 2;
		nBufRemaining -= 2;
		}