Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 95edbc30 authored by Dan Carpenter's avatar Dan Carpenter Committed by John W. Linville
Browse files

mwifiex: potential integer underflow in mwifiex_ret_wmm_get_status() 



Before we loop for next iteration we adjust the buffer pointer and
"resp_len":

		curr += (tlv_len + sizeof(tlv_hdr->header));
		resp_len -= (tlv_len + sizeof(tlv_hdr->header));

If "resp_len" gets set to negative then it counts as a high positive
value.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: default avatarBing Zhao <bzhao@marvell.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 3aef7dde

drivers/net/wireless/mwifiex/wmm.c

+3 −0
Original line number Diff line number Diff line
@@ -722,6 +722,9 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv, 
		tlv_hdr = (struct mwifiex_ie_types_data *) curr;

		tlv_len = le16_to_cpu(tlv_hdr->header.len);



		if (resp_len < tlv_len + sizeof(tlv_hdr->header))

			break;



		switch (le16_to_cpu(tlv_hdr->header.type)) {

		case TLV_TYPE_WMMQSTATUS:

			tlv_wmm_qstatus =