Parcourir la source

HS 2.0: More explicit hs20_osu_icon_fetch() length validation

The previous version was fine, but too much for some static analyzers to
understand as proper bounds checking. (CID 68122)

Signed-off-by: Jouni Malinen <j@w1.fi>
Jouni Malinen il y a 10 ans
Parent
commit
5c58c0ce86
1 fichiers modifiés avec 1 ajouts et 1 suppressions
  1. 1 1
      wpa_supplicant/hs20_supplicant.c

+ 1 - 1
wpa_supplicant/hs20_supplicant.c

@@ -778,7 +778,7 @@ void hs20_osu_icon_fetch(struct wpa_supplicant *wpa_s)
 			num_providers--;
 			len = WPA_GET_LE16(pos);
 			pos += 2;
-			if (pos + len > end)
+			if (len > (unsigned int) (end - pos))
 				break;
 			hs20_osu_add_prov(wpa_s, bss, osu_ssid,
 					  osu_ssid_len, pos, len);