wscutil: Avoid potential overflow
When checking that the length is valid, avoid potentially overflowing 'start + len'
This commit is contained in:
parent
22faf3482c
commit
5e9178b9de
|
@ -61,7 +61,7 @@ bool wsc_wfa_ext_iter_next(struct wsc_wfa_ext_iter *iter)
|
||||||
len = *start;
|
len = *start;
|
||||||
start += 1;
|
start += 1;
|
||||||
|
|
||||||
if (start + len > end)
|
if (len > end - start)
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
iter->type = type;
|
iter->type = type;
|
||||||
|
@ -98,7 +98,7 @@ bool wsc_attr_iter_next(struct wsc_attr_iter *iter)
|
||||||
len = l_get_be16(start);
|
len = l_get_be16(start);
|
||||||
start += 2;
|
start += 2;
|
||||||
|
|
||||||
if (start + len > end)
|
if (len > end - start)
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
iter->type = type;
|
iter->type = type;
|
||||||
|
|
Loading…
Reference in New Issue