diff options
| author | Naveen Rawat <naveenrawat@codeaurora.org> | 2016-11-17 11:28:40 -0800 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-11-22 20:11:35 -0800 |
| commit | 22afb93004c037b92d08abff647cf5577129b18d (patch) | |
| tree | e8b5dad0e9da9c0db43177e8323eb653e6ab0e34 | |
| parent | edd0105e0669fc43013668723051248d0cebf347 (diff) | |
qcacld-3.0: Fix num_rates check in lim_populate_matching_rate_set
In function lim_populate_matching_rate_set, sum of num_rates is being
checked against max array size but it does not take into account 8-bit
arithmetic overflow in calculating sum. Because of this even though
actual sum is greater than max array size, it might wrap around and be
less than max array size thus failing the condition. Perform 16-bit
arithmetic sum instead to avoid overflow.
Change-Id: Ia078e37891835540c974347ec6b5c9794300e264
CRs-Fixed: 1091486
| -rw-r--r-- | core/mac/src/pe/lim/lim_assoc_utils.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/core/mac/src/pe/lim/lim_assoc_utils.c b/core/mac/src/pe/lim/lim_assoc_utils.c index d859282617ed..f7bf5fc279ce 100644 --- a/core/mac/src/pe/lim/lim_assoc_utils.c +++ b/core/mac/src/pe/lim/lim_assoc_utils.c @@ -1893,7 +1893,13 @@ tSirRetStatus lim_populate_matching_rate_set(tpAniSirGlobal mac_ctx, temp_rate_set2.numRates = 0; } - if ((temp_rate_set.numRates + temp_rate_set2.numRates) > 12) { + /* + * absolute sum of both num_rates should be less than 12. following + * 16-bit sum avoids false codition where 8-bit arthematic overflow + * might have caused total sum to be less than 12 + */ + if (((uint16_t)temp_rate_set.numRates + + (uint16_t)temp_rate_set2.numRates) > 12) { lim_log(mac_ctx, LOGE, FL("more than 12 rates in CFG")); return eSIR_FAILURE; } |