Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8ab57b25 authored by Jakub Pawlowski's avatar Jakub Pawlowski Committed by Automerger Merge Worker
Browse files

Fix potential stack overflow caused by integer overflow am: 64fc0f21 

Change-Id: Iaf75d5b63297d50e3115422f15fa8511133ef45a
parents 20a9d871 64fc0f21

system/stack/smp/smp_cmac.cc

+2 −1
Original line number Original line Diff line number Diff line
@@ -278,7 +278,8 @@ static bool cmac_generate_subkey(BT_OCTET16 key) { 
 ******************************************************************************/

 ******************************************************************************/

bool aes_cipher_msg_auth_code(BT_OCTET16 key, uint8_t* input, uint16_t length,

bool aes_cipher_msg_auth_code(BT_OCTET16 key, uint8_t* input, uint16_t length,

                              uint16_t tlen, uint8_t* p_signature) {

                              uint16_t tlen, uint8_t* p_signature) {

  uint16_t len, diff;

  uint32_t len;

  uint16_t diff;

  uint16_t n = (length + BT_OCTET16_LEN - 1) /

  uint16_t n = (length + BT_OCTET16_LEN - 1) /

               BT_OCTET16_LEN; /* n is number of rounds */

               BT_OCTET16_LEN; /* n is number of rounds */

  bool ret = false;

  bool ret = false;