wlan: Fix integer truncation in convert_wsc_opaque
Propagation from qcacld-3.0 to prima
In the function convert_wsc_opaque, driver does
copy of the new parameters present in the
additional IEs of the upstream assoc request frame.
While copy of the IE length pOld->length to
curAddIELen, possible integer truncation could occur, as the
curAddIELen is of the type uint8_t whereas pOld->length is of
type uint16_t.
Change the data type of curAddIELen to uint16_t.
Make changes in convert_p2p_opaque and
convert_wfd_opaque as well.
Issue: SEC-1825
Change-Id: I9320135f73fdfd9266aa8f4baf67186b99b05d36
CRs-Fixed: 2517889
Signed-off-by: Gururaj Patil <gururaj.patil3@harman.com>
diff --git a/drivers/staging/prima/CORE/SYS/legacy/src/utils/src/utilsParser.c b/drivers/staging/prima/CORE/SYS/legacy/src/utils/src/utilsParser.c
index 98b09b6..d18004d 100644
--- a/drivers/staging/prima/CORE/SYS/legacy/src/utils/src/utilsParser.c
+++ b/drivers/staging/prima/CORE/SYS/legacy/src/utils/src/utilsParser.c
@@ -136,7 +136,7 @@
{
// This is awful, I know, but the old code just rammed the IE into
// an opaque array. Note that we need to explicitly add the vendorIE and OUI !
- tANI_U8 curAddIELen = pOld->length;
+ tANI_U16 curAddIELen = pOld->length;
pOld->length = curAddIELen + pNew->num_data + 6;
pOld->addIEdata[ curAddIELen++ ] = 0xdd;
@@ -156,7 +156,7 @@
{
// This is awful, I know, but the old code just rammed the IE into
// an opaque array. Note that we need to explicitly add the vendorIE and OUI !
- tANI_U8 curAddIELen = pOld->length;
+ tANI_U16 curAddIELen = pOld->length;
pOld->length = curAddIELen + pNew->num_data + 6;
pOld->addIEdata[ curAddIELen++ ] = 0xdd;
@@ -177,7 +177,7 @@
{
// This is awful, I know, but the old code just rammed the IE into
// an opaque array. Note that we need to explicitly add the vendorIE and OUI !
- tANI_U8 curAddIELen = pOld->length;
+ tANI_U16 curAddIELen = pOld->length;
pOld->length = curAddIELen + pNew->num_data + 6;
pOld->addIEdata[ curAddIELen++ ] = 0xdd;