wlan: Fix integer truncation in convert_wsc_opaque
Propagation from qcacld-3.0 to prima
In the function convert_wsc_opaque, driver does copy of the
new parameters present in the additional IEs of the upstream
assoc request frame. While copy of the IE length pOld->length to
curAddIELen, possible integer truncation could occur, as the
curAddIELen is of the type uint8_t whereas pOld->length is of
type uint16_t.
Change the data type of curAddIELen to uint16_t. Make changes in
convert_p2p_opaque and convert_wfd_opaque as well.
Change-Id: Ic26660fca4a02a265bfc9553b066c7ee42f1d1f4
CRs-Fixed: 2517889
diff --git a/CORE/SYS/legacy/src/utils/src/utilsParser.c b/CORE/SYS/legacy/src/utils/src/utilsParser.c
index 32f1992..c5f27a8 100644
--- a/CORE/SYS/legacy/src/utils/src/utilsParser.c
+++ b/CORE/SYS/legacy/src/utils/src/utilsParser.c
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2011-2015, 2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2015, 2017-2019 The Linux Foundation. All rights reserved.
*
* Previously licensed under the ISC license by Qualcomm Atheros, Inc.
*
@@ -136,7 +136,7 @@
{
// This is awful, I know, but the old code just rammed the IE into
// an opaque array. Note that we need to explicitly add the vendorIE and OUI !
- tANI_U8 curAddIELen = pOld->length;
+ tANI_U16 curAddIELen = pOld->length;
pOld->length = curAddIELen + pNew->num_data + 6;
pOld->addIEdata[ curAddIELen++ ] = 0xdd;
@@ -156,7 +156,7 @@
{
// This is awful, I know, but the old code just rammed the IE into
// an opaque array. Note that we need to explicitly add the vendorIE and OUI !
- tANI_U8 curAddIELen = pOld->length;
+ tANI_U16 curAddIELen = pOld->length;
pOld->length = curAddIELen + pNew->num_data + 6;
pOld->addIEdata[ curAddIELen++ ] = 0xdd;
@@ -177,7 +177,7 @@
{
// This is awful, I know, but the old code just rammed the IE into
// an opaque array. Note that we need to explicitly add the vendorIE and OUI !
- tANI_U8 curAddIELen = pOld->length;
+ tANI_U16 curAddIELen = pOld->length;
pOld->length = curAddIELen + pNew->num_data + 6;
pOld->addIEdata[ curAddIELen++ ] = 0xdd;