anqputil: Avoid potential overflow
When checking that the length is valid, avoid potentially overflowing 'anqp + l_get_le16(anqp + 2)'
This commit is contained in:
parent
d2ca0c4f18
commit
60e0a5073a
|
@ -48,7 +48,7 @@ bool anqp_iter_next(struct anqp_iter *iter, uint16_t *id, uint16_t *len,
|
||||||
if (iter->pos + 4 >= iter->max)
|
if (iter->pos + 4 >= iter->max)
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
if (anqp + l_get_le16(anqp + 2) > end)
|
if (l_get_le16(anqp + 2) > end - anqp)
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
*id = l_get_le16(anqp);
|
*id = l_get_le16(anqp);
|
||||||
|
|
Loading…
Reference in New Issue