aboutsummaryrefslogtreecommitdiffstats
path: root/wpa_supplicant
diff options
context:
space:
mode:
authorJouni Malinen <j@w1.fi>2019-02-23 10:49:17 (GMT)
committerJouni Malinen <j@w1.fi>2019-02-25 17:42:50 (GMT)
commit01d01a311c52d56709eaadc5ffbbe7a7d773b041 (patch)
treea7faa756874ad190e15ddc3c578b4816455e3155 /wpa_supplicant
parentec2e7c4cfa171dca26977ce64953b289e2640794 (diff)
downloadhostap-01d01a311c52d56709eaadc5ffbbe7a7d773b041.zip
hostap-01d01a311c52d56709eaadc5ffbbe7a7d773b041.tar.gz
hostap-01d01a311c52d56709eaadc5ffbbe7a7d773b041.tar.bz2
UBSan: Avoid size_t variable overflow in control interface
The loop "if (i-- == 0) break" style construction works in practice fine since the check against 0 is done before decrementation. However, this hits an UBSan warning, so split that decrementation to happen as a separate step after the check and break from the loop. ctrl_iface.c:5086:9: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'size_t' (aka 'unsigned long') Signed-off-by: Jouni Malinen <j@w1.fi>
Diffstat (limited to 'wpa_supplicant')
-rw-r--r--wpa_supplicant/ctrl_iface.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
index 80f2d08..013d05c 100644
--- a/wpa_supplicant/ctrl_iface.c
+++ b/wpa_supplicant/ctrl_iface.c
@@ -5083,10 +5083,11 @@ static int wpa_supplicant_ctrl_iface_bss(struct wpa_supplicant *wpa_s,
bss = NULL;
dl_list_for_each(tmp, &wpa_s->bss_id, struct wpa_bss, list_id)
{
- if (i-- == 0) {
+ if (i == 0) {
bss = tmp;
break;
}
+ i--;
}
}