mwifiex: potential integer underflow in mwifiex_ret_wmm_get_status()
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 22 Oct 2013 22:24:42 +0000 (15:24 -0700)
committerJohn W. Linville <linville@tuxdriver.com>
Mon, 11 Nov 2013 19:38:56 +0000 (14:38 -0500)
Before we loop for next iteration we adjust the buffer pointer and
"resp_len":

curr += (tlv_len + sizeof(tlv_hdr->header));
resp_len -= (tlv_len + sizeof(tlv_hdr->header));

If "resp_len" gets set to negative then it counts as a high positive
value.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/mwifiex/wmm.c

index 5dd0ccc..13eaeed 100644 (file)
@@ -722,6 +722,9 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
                tlv_hdr = (struct mwifiex_ie_types_data *) curr;
                tlv_len = le16_to_cpu(tlv_hdr->header.len);
 
+               if (resp_len < tlv_len + sizeof(tlv_hdr->header))
+                       break;
+
                switch (le16_to_cpu(tlv_hdr->header.type)) {
                case TLV_TYPE_WMMQSTATUS:
                        tlv_wmm_qstatus =