diff options
| author | Vignesh Viswanathan <viswanat@codeaurora.org> | 2017-09-19 18:37:12 +0530 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-10-09 19:44:12 -0700 |
| commit | ffdf994f79e949572d74dd1ae8fc405c76037add (patch) | |
| tree | ced02dd8cc5bbce796a5fe02821a1eb75c6fad3f /uapi/linux | |
| parent | 4621b188f317f5534878f74374c6b90ab8f460bc (diff) | |
qcacld-3.0: Fix potential infinite loop in get_container_ies_len
In the function get_container_ies_len, len (uint32) is calculated
from the length of the buffer parsed. Then it is copied to the uint8
pnConsumed pointer from the calling function. This could lead to
pnConsumed becoming 0 if len exceeds 255 and would cause infinte
loop in the function unpack_core.
Add changes to make pnConsumed passed from unpack_core to be uint32
so that there are no issues in get_container_ies_len
Change-Id: Ia5770b4becf7dd1cf7cb97ec2e0d94f3c5f4ed54
CRs-Fixed: 2101200
Diffstat (limited to 'uapi/linux')
0 files changed, 0 insertions, 0 deletions