WFD: Use cleaner bounds checking for sub-element length field

Mark the variable as unsigned and make the length check use "len > end -
pos" version to makes this easier to understand for static analyzers
(CID 74155).

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/wifi_display.c b/wpa_supplicant/wifi_display.c
index 6dc41dec077e0361cb14f6a05d72d6b91220baa0..715b67729ae364c4da52ba7450fd6265c02f03ef 100644 (file)
--- a/wpa_supplicant/wifi_display.c
+++ b/wpa_supplicant/wifi_display.c
@@ -271,7 +271,7 @@ int wifi_display_subelem_set_from_ies(struct wpa_global *global,
 {
        int subelements[MAX_WFD_SUBELEMS] = {};
        const u8 *pos, *end;
-       int len, subelem;
+       unsigned int len, subelem;
        struct wpabuf *e;
 
        wpa_printf(MSG_DEBUG, "WFD IEs set: %p - %lu",
@@ -292,7 +292,7 @@ int wifi_display_subelem_set_from_ies(struct wpa_global *global,
                wpa_printf(MSG_DEBUG, "WFD Sub-Element ID %d - len %d",
                           *pos, len - 3);
 
-               if (pos + len > end)
+               if (len > end - pos)
                        break;
 
                subelem = *pos;