Fix Visual C++ code analysis errors.
svn path=/trunk/; revision=35970
This commit is contained in:
parent
64666812e9
commit
69901e8eba
|
@ -995,6 +995,7 @@ AirPDcapRsnaMng(
|
||||||
{
|
{
|
||||||
INT ret_value=1;
|
INT ret_value=1;
|
||||||
UCHAR *try_data;
|
UCHAR *try_data;
|
||||||
|
guint try_data_len = *decrypt_len;
|
||||||
|
|
||||||
if (sa->key==NULL) {
|
if (sa->key==NULL) {
|
||||||
AIRPDCAP_DEBUG_PRINT_LINE("AirPDcapRsnaMng", "No key associated", AIRPDCAP_DEBUG_LEVEL_3);
|
AIRPDCAP_DEBUG_PRINT_LINE("AirPDcapRsnaMng", "No key associated", AIRPDCAP_DEBUG_LEVEL_3);
|
||||||
|
@ -1006,11 +1007,16 @@ AirPDcapRsnaMng(
|
||||||
}
|
}
|
||||||
|
|
||||||
/* allocate a temp buffer for the decryption loop */
|
/* allocate a temp buffer for the decryption loop */
|
||||||
try_data=(UCHAR *)ep_alloc(*decrypt_len);
|
try_data=(UCHAR *)ep_alloc(try_data_len);
|
||||||
|
|
||||||
/* start of loop added by GCS */
|
/* start of loop added by GCS */
|
||||||
for(/* sa */; sa != NULL ;sa=sa->next) {
|
for(/* sa */; sa != NULL ;sa=sa->next) {
|
||||||
|
|
||||||
|
if (*decrypt_len > try_data_len) {
|
||||||
|
AIRPDCAP_DEBUG_PRINT_LINE("AirPDcapRsnaMng", "Invalid decryption length", AIRPDCAP_DEBUG_LEVEL_3);
|
||||||
|
return AIRPDCAP_RET_UNSUCCESS;
|
||||||
|
}
|
||||||
|
|
||||||
/* copy the encrypted data into a temp buffer */
|
/* copy the encrypted data into a temp buffer */
|
||||||
memcpy(try_data, decrypt_data, *decrypt_len);
|
memcpy(try_data, decrypt_data, *decrypt_len);
|
||||||
|
|
||||||
|
@ -1050,6 +1056,11 @@ AirPDcapRsnaMng(
|
||||||
if(sa == NULL)
|
if(sa == NULL)
|
||||||
return ret_value;
|
return ret_value;
|
||||||
|
|
||||||
|
if (*decrypt_len > try_data_len || *decrypt_len < 8) {
|
||||||
|
AIRPDCAP_DEBUG_PRINT_LINE("AirPDcapRsnaMng", "Invalid decryption length", AIRPDCAP_DEBUG_LEVEL_3);
|
||||||
|
return AIRPDCAP_RET_UNSUCCESS;
|
||||||
|
}
|
||||||
|
|
||||||
/* copy the decrypted data into the decrypt buffer GCS*/
|
/* copy the decrypted data into the decrypt buffer GCS*/
|
||||||
memcpy(decrypt_data, try_data, *decrypt_len);
|
memcpy(decrypt_data, try_data, *decrypt_len);
|
||||||
|
|
||||||
|
@ -1089,7 +1100,10 @@ AirPDcapWepMng(
|
||||||
INT key_index;
|
INT key_index;
|
||||||
AIRPDCAP_KEY_ITEM *tmp_key;
|
AIRPDCAP_KEY_ITEM *tmp_key;
|
||||||
UINT8 useCache=FALSE;
|
UINT8 useCache=FALSE;
|
||||||
UCHAR *try_data = (UCHAR *)ep_alloc(*decrypt_len);
|
UCHAR *try_data;
|
||||||
|
guint try_data_len = *decrypt_len;
|
||||||
|
|
||||||
|
try_data = (UCHAR *)ep_alloc(try_data_len);
|
||||||
|
|
||||||
if (sa->key!=NULL)
|
if (sa->key!=NULL)
|
||||||
useCache=TRUE;
|
useCache=TRUE;
|
||||||
|
@ -1159,6 +1173,11 @@ AirPDcapWepMng(
|
||||||
/* remove ICV (4bytes) from the end of packet */
|
/* remove ICV (4bytes) from the end of packet */
|
||||||
*decrypt_len-=4;
|
*decrypt_len-=4;
|
||||||
|
|
||||||
|
if (*decrypt_len < 4) {
|
||||||
|
AIRPDCAP_DEBUG_PRINT_LINE("AirPDcapWepMng", "Decryption length too short", AIRPDCAP_DEBUG_LEVEL_3);
|
||||||
|
return AIRPDCAP_RET_UNSUCCESS;
|
||||||
|
}
|
||||||
|
|
||||||
/* remove protection bit */
|
/* remove protection bit */
|
||||||
decrypt_data[1]&=0xBF;
|
decrypt_data[1]&=0xBF;
|
||||||
|
|
||||||
|
@ -1702,6 +1721,9 @@ AirPDcapRsnaPwd2PskStep(
|
||||||
UCHAR digest[36], digest1[AIRPDCAP_SHA_DIGEST_LEN];
|
UCHAR digest[36], digest1[AIRPDCAP_SHA_DIGEST_LEN];
|
||||||
INT i, j;
|
INT i, j;
|
||||||
|
|
||||||
|
if (ssidLength > 36 - 4)
|
||||||
|
return AIRPDCAP_RET_UNSUCCESS;
|
||||||
|
|
||||||
/* U1 = PRF(P, S || INT(i)) */
|
/* U1 = PRF(P, S || INT(i)) */
|
||||||
memcpy(digest, ssid, ssidLength);
|
memcpy(digest, ssid, ssidLength);
|
||||||
digest[ssidLength] = (UCHAR)((count>>24) & 0xff);
|
digest[ssidLength] = (UCHAR)((count>>24) & 0xff);
|
||||||
|
|
|
@ -149,7 +149,7 @@ static void ccmp_init_blocks(
|
||||||
aad[2] = (UINT8)(wh->fc[0] & 0x8f); /* XXX magic #s */
|
aad[2] = (UINT8)(wh->fc[0] & 0x8f); /* XXX magic #s */
|
||||||
aad[3] = (UINT8)(wh->fc[1] & 0xc7); /* XXX magic #s */
|
aad[3] = (UINT8)(wh->fc[1] & 0xc7); /* XXX magic #s */
|
||||||
/* NB: we know 3 addresses are contiguous */
|
/* NB: we know 3 addresses are contiguous */
|
||||||
memcpy(aad + 4, wh->addr1, 3 * AIRPDCAP_MAC_LEN);
|
memcpy(aad + 4, &wh->addr1[0], 3 * AIRPDCAP_MAC_LEN);
|
||||||
aad[22] = (UINT8)(wh->seq[0] & AIRPDCAP_SEQ_FRAG_MASK);
|
aad[22] = (UINT8)(wh->seq[0] & AIRPDCAP_SEQ_FRAG_MASK);
|
||||||
aad[23] = 0; /* all bits masked */
|
aad[23] = 0; /* all bits masked */
|
||||||
/*
|
/*
|
||||||
|
|
Loading…
Reference in New Issue