qcacld-3.0: Fix integer truncation in convert_wsc_opaque
In the function convert_wsc_opaque, driver does copy of the
new parameters present in the additional IEs of the upstream
assoc request frame. While copy of the IE length pOld->length to
curAddIELen, possible integer truncation could occur, as the
curAddIELen is of the type uint8_t whereas pOld->length is of
type uint16_t.
Change the data type of curAddIELen to uint16_t. Make changes in
convert_p2p_opaque and convert_wfd_opaque as well.
Change-Id: Ic26660fca4a02a265bfc9553b066c7ee42f1d1f4
CRs-Fixed: 2231770
diff --git a/core/mac/src/sys/legacy/src/utils/src/utils_parser.c b/core/mac/src/sys/legacy/src/utils/src/utils_parser.c
index 07889b2..a06c4f9 100644
--- a/core/mac/src/sys/legacy/src/utils/src/utils_parser.c
+++ b/core/mac/src/sys/legacy/src/utils/src/utils_parser.c
@@ -131,7 +131,7 @@
{
/* This is awful, I know, but the old code just rammed the IE into */
/* an opaque array. Note that we need to explicitly add the vendorIE and OUI ! */
- uint8_t curAddIELen = pOld->length;
+ uint16_t curAddIELen = pOld->length;
pOld->length = curAddIELen + pNew->num_data + 6;
pOld->addIEdata[curAddIELen++] = 0xdd;
@@ -150,7 +150,7 @@
{
/* This is awful, I know, but the old code just rammed the IE into */
/* an opaque array. Note that we need to explicitly add the vendorIE and OUI ! */
- uint8_t curAddIELen = pOld->length;
+ uint16_t curAddIELen = pOld->length;
pOld->length = curAddIELen + pNew->num_data + 6;
pOld->addIEdata[curAddIELen++] = 0xdd;
@@ -170,7 +170,7 @@
{
/* This is awful, I know, but the old code just rammed the IE into */
/* an opaque array. Note that we need to explicitly add the vendorIE and OUI ! */
- uint8_t curAddIELen = pOld->length;
+ uint16_t curAddIELen = pOld->length;
pOld->length = curAddIELen + pNew->num_data + 6;
pOld->addIEdata[curAddIELen++] = 0xdd;