In __ws_segment_to_service, max len can be 255 59/63359/2
authorNishant Chaprana <n.chaprana@samsung.com>
Wed, 23 Mar 2016 09:38:26 +0000 (15:08 +0530)
committerNishant Chaprana <n.chaprana@samsung.com>
Tue, 29 Mar 2016 05:49:42 +0000 (11:19 +0530)
This patch fixes the false comparision statement
because __ws_hex_to_num(ptr, 2) can return max 0xff which is 255.
and comparision was made between
return of __ws_hex_to_num(ptr, 2) with 0xffff which is wrong.
This comparision should be with 0xff.

Change-Id: Iaadbfa7ce002de382fd7e0356d53e89454eac9a6
Signed-off-by: Nishant Chaprana <n.chaprana@samsung.com>
packaging/wifi-direct-manager.spec
plugin/wpasupplicant/ctrl_iface_dbus/wfd-plugin-wpasupplicant.c

index c00c7bc..ec22331 100755 (executable)
@@ -1,6 +1,6 @@
 Name:          wifi-direct-manager
 Summary:       Wi-Fi Direct manger
-Version:       1.2.149
+Version:       1.2.150
 Release:       1
 Group:      Network & Connectivity/Wireless
 License:    Apache-2.0
index 6d84537..60bfd51 100755 (executable)
@@ -283,12 +283,12 @@ static int __ws_segment_to_service(char *segment, wfd_oem_new_service_s **servic
 
                while (*ptr != 0 && strncmp(ptr, "c0", 2)) {
                        len = __ws_hex_to_num(ptr, 2);
-                       ptr +=2;
-                       if (len && len <= 0xffff) {
+                       ptr += 2;
+                       if (len && len <= 0xff) {
                                temp = (char*) calloc(1, len+2);
                                if (temp) {
                                        temp[0] = '.';
-                                       for (i=0; i<len; i++) {
+                                       for (i = 0; i < len; i++) {
                                                temp[i+1] = (char) __ws_hex_to_num(ptr, 2);
                                                ptr += 2;
                                        }
@@ -324,11 +324,11 @@ static int __ws_segment_to_service(char *segment, wfd_oem_new_service_s **servic
                while (*ptr != 0 && strncmp(ptr, "c0", 2)) {
                        len = __ws_hex_to_num(ptr, 2);
                        ptr += 2;
-                       if (len && len <= 0xffff) {
+                       if (len && len <= 0xff) {
                                temp = (char*) g_try_malloc0(len+2);
                                if (temp) {
                                        temp[0] = '.';
-                                       for (i=0; i<len; i++) {
+                                       for (i = 0; i < len; i++) {
                                                temp[i+1] = (char) __ws_hex_to_num(ptr, 2);
                                                ptr += 2;
                                        }