wlan: Fix for kernel panic when connecting p2p to Samsung Smart TV.
As per Stability team's analysis, nBufRemaining value in UnpackTlvCore()
function was set to abnormally big value when data is incomplete. And it
led to kernel crash.
Adding a length check to avoid the kernel panic.
Change-Id: Iaf3d597c6ef707a519430749d99ed9bd35bfa6e5
CR-Fixed: 415609
diff --git a/CORE/MAC/src/include/dot11f.h b/CORE/MAC/src/include/dot11f.h
index 376153c..609bd85 100644
--- a/CORE/MAC/src/include/dot11f.h
+++ b/CORE/MAC/src/include/dot11f.h
@@ -35,7 +35,7 @@
*
*
* This file was automatically generated by 'framesc'
- * Tue Sep 11 13:23:29 2012 from the following file(s):
+ * Tue Oct 30 12:06:13 2012 from the following file(s):
*
* dot11f.frms
*
diff --git a/CORE/SYS/legacy/src/utils/src/dot11f.c b/CORE/SYS/legacy/src/utils/src/dot11f.c
index e2c5a61..261d102 100644
--- a/CORE/SYS/legacy/src/utils/src/dot11f.c
+++ b/CORE/SYS/legacy/src/utils/src/dot11f.c
@@ -33,7 +33,7 @@
*
*
* This file was automatically generated by 'framesc'
- * Tue Sep 11 13:23:29 2012 from the following file(s):
+ * Tue Oct 30 12:06:13 2012 from the following file(s):
*
* dot11f.frms
*
@@ -18804,6 +18804,14 @@
pBufRemaining += TLVs[0].sType;
nBufRemaining -= TLVs[0].sType;
framesntohs(pCtx, &len, pBufRemaining, (TLVs[0].sType == 2));
+ if ( 2 > nBufRemaining )
+ {
+ FRAMES_LOG0( pCtx, FRLOGE, FRFL("This frame reports "
+ "fewer two byte(s) remaining.\n") );
+ status |= DOT11F_INCOMPLETE_TLV;
+ FRAMES_DBG_BREAK();
+ goto MandatoryCheck;
+ }
pBufRemaining += 2;
nBufRemaining -= 2;
}