mirror of
https://github.com/lwfinger/rtl8188eu.git
synced 2024-11-09 23:19:39 +00:00
rtl8188eu: Fix infinite loop in rtw_get_wps_ie()
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
This commit is contained in:
parent
30901e601a
commit
e43ffc5f23
1 changed files with 3 additions and 0 deletions
|
@ -747,6 +747,7 @@ u8 *rtw_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen)
|
||||||
uint cnt;
|
uint cnt;
|
||||||
u8 *wpsie_ptr = NULL;
|
u8 *wpsie_ptr = NULL;
|
||||||
u8 eid, wps_oui[4] = {0x0, 0x50, 0xf2, 0x04};
|
u8 eid, wps_oui[4] = {0x0, 0x50, 0xf2, 0x04};
|
||||||
|
int loop = 0;
|
||||||
|
|
||||||
if (wps_ielen)
|
if (wps_ielen)
|
||||||
*wps_ielen = 0;
|
*wps_ielen = 0;
|
||||||
|
@ -774,6 +775,8 @@ u8 *rtw_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen)
|
||||||
} else {
|
} else {
|
||||||
cnt += in_ie[cnt+1]+2; /* goto next */
|
cnt += in_ie[cnt+1]+2; /* goto next */
|
||||||
}
|
}
|
||||||
|
if (++loop > 1000)
|
||||||
|
return NULL;
|
||||||
}
|
}
|
||||||
return wpsie_ptr;
|
return wpsie_ptr;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue