aboutsummaryrefslogtreecommitdiffstats
path: root/wpa_supplicant/wifi_display.c
diff options
context:
space:
mode:
authorJouni Malinen <j@w1.fi>2014-10-11 15:40:32 (GMT)
committerJouni Malinen <j@w1.fi>2014-10-11 15:40:32 (GMT)
commit4debeb42a65c39638159b1a1b952e156f9c92940 (patch)
tree7d17f634342ce726e0e7ccdb7cceb5c28a7df525 /wpa_supplicant/wifi_display.c
parentc061ae590aec1765e660fa9dc00cbcb5479f5b3e (diff)
downloadhostap-4debeb42a65c39638159b1a1b952e156f9c92940.zip
hostap-4debeb42a65c39638159b1a1b952e156f9c92940.tar.gz
hostap-4debeb42a65c39638159b1a1b952e156f9c92940.tar.bz2
WFD: Use cleaner bounds checking for sub-element length field
Mark the variable as unsigned and make the length check use "len > end - pos" version to makes this easier to understand for static analyzers (CID 74155). Signed-off-by: Jouni Malinen <j@w1.fi>
Diffstat (limited to 'wpa_supplicant/wifi_display.c')
-rw-r--r--wpa_supplicant/wifi_display.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/wpa_supplicant/wifi_display.c b/wpa_supplicant/wifi_display.c
index 6dc41de..715b677 100644
--- a/wpa_supplicant/wifi_display.c
+++ b/wpa_supplicant/wifi_display.c
@@ -271,7 +271,7 @@ int wifi_display_subelem_set_from_ies(struct wpa_global *global,
{
int subelements[MAX_WFD_SUBELEMS] = {};
const u8 *pos, *end;
- int len, subelem;
+ unsigned int len, subelem;
struct wpabuf *e;
wpa_printf(MSG_DEBUG, "WFD IEs set: %p - %lu",
@@ -292,7 +292,7 @@ int wifi_display_subelem_set_from_ies(struct wpa_global *global,
wpa_printf(MSG_DEBUG, "WFD Sub-Element ID %d - len %d",
*pos, len - 3);
- if (pos + len > end)
+ if (len > end - pos)
break;
subelem = *pos;