commit e263d9e4a7e0708935d0a08646b4bd620817f195
author Kiran Kumar Lokere <klokere@qca.qualcomm.com> Thu Nov 07 19:01:17 2013 -0800
committer Kiet Lam <kietl@codeaurora.org> Sat Nov 23 19:22:17 2013 -0800
tree 3b40378e5f429848c0bd121fc54ad61aacf8f5f0
parent a6c11e1872092eed592c933ae603b644dddc47ad

Fix the buffer overflow issue observed in static code analysis.

Fix the possible buffer overflow in IE parsing.

Change-Id: I1a386ac09dbe30562fbd84739eb8d61c6a09b001
CRs-Fixed: 553937, 553941

CORE/MAC/src/include/dot11f.h

diff --git a/CORE/MAC/src/include/dot11f.h b/CORE/MAC/src/include/dot11f.h
index 198b259..cc89258 100644
--- a/CORE/MAC/src/include/dot11f.h
+++ b/CORE/MAC/src/include/dot11f.h
@@ -52,7 +52,7 @@
   *
   *
   * This file was automatically generated by 'framesc'
-  * Thu Jul 11 19:02:48 2013 from the following file(s):
+  * Thu Nov  7 16:38:38 2013 from the following file(s):
   *
   * dot11f.frms
   * 

CORE/SYS/legacy/src/utils/src/dot11f.c

diff --git a/CORE/SYS/legacy/src/utils/src/dot11f.c b/CORE/SYS/legacy/src/utils/src/dot11f.c
index 04e651e..4f67b90 100644
--- a/CORE/SYS/legacy/src/utils/src/dot11f.c
+++ b/CORE/SYS/legacy/src/utils/src/dot11f.c
@@ -29,7 +29,7 @@
   *
   *
   * This file was automatically generated by 'framesc'
-  * Thu Jul 11 19:02:48 2013 from the following file(s):
+  * Thu Nov  7 16:38:38 2013 from the following file(s):
   *
   * dot11f.frms
   * 
@@ -2976,7 +2976,7 @@
     else
     {
         pDst->num_triplets = (tANI_U8)( ielen / 3 );
-        if (ielen / 3 > 84){
+        if (ielen > 84 * 3){
                 pDst->present = 0;
                 return DOT11F_SKIPPED_BAD_IE;
         }
@@ -4650,7 +4650,7 @@
     if (pDst->present) status = DOT11F_DUPLICATE_IE;
     pDst->present = 1;
     pDst->num_bands = (tANI_U8)( ielen / 2 );
-    if (ielen / 2 > 48){
+    if (ielen > 48 * 2){
         pDst->present = 0;
         return DOT11F_SKIPPED_BAD_IE;
     }