P2P NFC: Make code easier for static analyzers

len + pos > end comparison here did verify that the length field had a
valid value, but that did not seem to enough to avoid TAINTED_SCALAR
warning. Re-order that validation step to be equivalent "len > end -
pos" to remove these false positives (CID 68116).

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/p2p_supplicant.c b/wpa_supplicant/p2p_supplicant.c
index 1b6919d0c2801dde961b7c5f26ca89b91cff2e6d..2aaee1fa35d6cc6043908bd5f8ad14a8b07620f7 100644 (file)
--- a/wpa_supplicant/p2p_supplicant.c
+++ b/wpa_supplicant/p2p_supplicant.c
@@ -7602,7 +7602,7 @@ static int wpas_p2p_nfc_connection_handover(struct wpa_supplicant *wpa_s,
        }
        len = WPA_GET_BE16(pos);
        pos += 2;
-       if (pos + len > end) {
+       if (len > end - pos) {
                wpa_printf(MSG_DEBUG, "P2P: Not enough data for WSC "
                           "attributes");
                return -1;
@@ -7618,7 +7618,7 @@ static int wpas_p2p_nfc_connection_handover(struct wpa_supplicant *wpa_s,
        }
        len = WPA_GET_BE16(pos);
        pos += 2;
-       if (pos + len > end) {
+       if (len > end - pos) {
                wpa_printf(MSG_DEBUG, "P2P: Not enough data for P2P "
                           "attributes");
                return -1;