Kernel
/
iwd
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git
3
0
Fork 0
Code Releases Activity

anqputil: Avoid potential overflow 

When checking that the length is valid, avoid potentially overflowing
    'anqp + l_get_le16(anqp + 2)'
This commit is contained in:
Denis Kenzior 2022-01-14 11:08:48 -06:00
parent d2ca0c4f18
commit 60e0a5073a
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/anqputil.c
View File

@ -48,7 +48,7 @@ bool anqp_iter_next(struct anqp_iter *iter, uint16_t *id, uint16_t *len,
if (iter->pos + 4 >= iter->max)
return false;
if (anqp + l_get_le16(anqp + 2) > end)
if (l_get_le16(anqp + 2) > end - anqp)
return false;
*id = l_get_le16(anqp);