| Message ID | 20200210094619.14416-1-markus.theil@tu-ilmenau.de (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Johannes Berg |
| Headers | show |
| Series | [1/2] iw: scan: fix endless loop in print_measurement_pilot_tx | expand |
On 2/10/20 10:46 AM, Markus Theil wrote: I forgot my signed-off-by, feel free to add. > --- > scan.c | 16 ++++++++++------ > 1 file changed, 10 insertions(+), 6 deletions(-) > > diff --git a/scan.c b/scan.c > index 98c5c10..a5beb0e 100644 > --- a/scan.c > +++ b/scan.c > @@ -1548,6 +1548,7 @@ static void print_measurement_pilot_tx(const uint8_t type, uint8_t len, > ++p; > uint8_t len = *p; > ++p; > + const uint8_t *end = p + len; > > len_remaining -= 2; > > @@ -1557,18 +1558,21 @@ static void print_measurement_pilot_tx(const uint8_t type, uint8_t len, > return; > } > > - printf("\t\t * vendor specific: OUI %.2x:%.2x:%.2x, data:", > - p[0], p[1], p[2]); > - len_remaining -= 3; > - > - if (len > len_remaining) { > + if (len < 3 || len > len_remaining) { > printf(" <Parse error, element too short>\n"); > return; > } > > - while (p < p + len) > + printf("\t\t * vendor specific: OUI %.2x:%.2x:%.2x, data:", > + p[0], p[1], p[2]); > + /* add only two here and use ++p in while loop */ > + p += 2; > + > + while (++p < end) > printf(" %.2x", *p); > printf("\n"); > + > + len_remaining -= len; > } > } >
diff --git a/scan.c b/scan.c index 98c5c10..a5beb0e 100644 --- a/scan.c +++ b/scan.c @@ -1548,6 +1548,7 @@ static void print_measurement_pilot_tx(const uint8_t type, uint8_t len, ++p; uint8_t len = *p; ++p; + const uint8_t *end = p + len; len_remaining -= 2; @@ -1557,18 +1558,21 @@ static void print_measurement_pilot_tx(const uint8_t type, uint8_t len, return; } - printf("\t\t * vendor specific: OUI %.2x:%.2x:%.2x, data:", - p[0], p[1], p[2]); - len_remaining -= 3; - - if (len > len_remaining) { + if (len < 3 || len > len_remaining) { printf(" <Parse error, element too short>\n"); return; } - while (p < p + len) + printf("\t\t * vendor specific: OUI %.2x:%.2x:%.2x, data:", + p[0], p[1], p[2]); + /* add only two here and use ++p in while loop */ + p += 2; + + while (++p < end) printf(" %.2x", *p); printf("\n"); + + len_remaining -= len; } }