Kernel/iwd
3
0
Fork 0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-10-04 02:18:49 +02:00
Code Releases Activity

wscutil: Avoid potential overflow

Browse Source 
When checking that the length is valid, avoid potentially overflowing
'start + len'
This commit is contained in:
Denis Kenzior 2022-01-14 09:45:49 -06:00
parent 22faf3482c
commit 5e9178b9de
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/wscutil.c
View File

@ -61,7 +61,7 @@ bool wsc_wfa_ext_iter_next(struct wsc_wfa_ext_iter *iter)
len = *start; len = *start;
start += 1; start += 1;
if (start + len > end) if (len > end - start)
return false; return false;
iter->type = type; iter->type = type;
@ -98,7 +98,7 @@ bool wsc_attr_iter_next(struct wsc_attr_iter *iter)
len = l_get_be16(start); len = l_get_be16(start);
start += 2; start += 2;
if (start + len > end) if (len > end - start)
return false; return false;
iter->type = type; iter->type = type;