diff options
| author | Treehugger Robot <android-test-infra-autosubmit@system.gserviceaccount.com> | 2024-03-29 08:52:14 +0000 |
|---|---|---|
| committer | Gerrit Code Review <noreply-gerritcodereview@google.com> | 2024-03-29 08:52:14 +0000 |
| commit | 49a4b7683b49a336388310f66ceff4c3e2b49545 (patch) | |
| tree | aca154d7d75ec43c9e715561e008848f1241285e | |
| parent | 11a9e94488bff9cb5dbfc8232b30c0f9d89b773a (diff) | |
| parent | 1619671c67999aca6bb3855c4a7c761b84a93a3e (diff) | |
| download | goldfish-49a4b7683b49a336388310f66ceff4c3e2b49545.tar.gz | |
Merge "Enhance size check in readPacketFilter to prevent overflow" into main
| -rw-r--r-- | wifi/wifi_hal/interface.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/wifi/wifi_hal/interface.cpp b/wifi/wifi_hal/interface.cpp index a79f900b..45ef7fb2 100644 --- a/wifi/wifi_hal/interface.cpp +++ b/wifi/wifi_hal/interface.cpp @@ -269,7 +269,7 @@ wifi_error Interface::getPacketFilterCapabilities(u32* version, wifi_error Interface::readPacketFilter(u32 src_offset, u8 *host_dst, u32 length) { if (src_offset >= mApfMemory.size() || host_dst == nullptr - || src_offset + length > mApfMemory.size()) { + || length > mApfMemory.size() - src_offset) { return WIFI_ERROR_INVALID_ARGS; } std::copy(mApfMemory.begin() + src_offset, mApfMemory.begin() + src_offset + length, host_dst); |