From 9f9a148af609d9dd2928287e6fa18b06a96ec7ee Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Sun, 22 Mar 2020 18:49:04 +0200
Subject: [PATCH] Convert int_array to use size_t instead of int as the length

This extends this to allow longer lists with LP32 data model to avoid
limit of 16-bit int.

Signed-off-by: Jouni Malinen <j@w1.fi>
---
 src/utils/common.c             | 26 +++++++++++++-------------
 src/utils/common.h             |  2 +-
 src/utils/utils_module_tests.c |  2 +-
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/src/utils/common.c b/src/utils/common.c
index 16aa7b6ee..2c1275193 100644
--- a/src/utils/common.c
+++ b/src/utils/common.c
@@ -879,9 +879,10 @@ char * freq_range_list_str(const struct wpa_freq_range_list *list)
 }
 
 
-int int_array_len(const int *a)
+size_t int_array_len(const int *a)
 {
-	int i;
+	size_t i;
+
 	for (i = 0; a && a[i]; i++)
 		;
 	return i;
@@ -890,25 +891,24 @@ int int_array_len(const int *a)
 
 void int_array_concat(int **res, const int *a)
 {
-	int reslen, alen, i, new_len;
+	size_t reslen, alen, i, max_size;
 	int *n;
 
 	reslen = int_array_len(*res);
 	alen = int_array_len(a);
-	new_len = reslen + alen + 1;
-	if (reslen < 0 || alen < 0 || new_len < 0) {
+	max_size = (size_t) -1;
+	if (alen >= max_size - reslen) {
 		/* This should not really happen, but if it did, something
-		 * overflowed. Do not try to merge the arrays; instead, make
+		 * would overflow. Do not try to merge the arrays; instead, make
 		 * this behave like memory allocation failure to avoid messing
 		 * up memory. */
 		os_free(*res);
 		*res = NULL;
 		return;
 	}
-	n = os_realloc_array(*res, new_len, sizeof(int));
+	n = os_realloc_array(*res, reslen + alen + 1, sizeof(int));
 	if (n == NULL) {
-		if (new_len)
-			os_free(*res);
+		os_free(*res);
 		*res = NULL;
 		return;
 	}
@@ -933,8 +933,7 @@ static int freq_cmp(const void *a, const void *b)
 
 void int_array_sort_unique(int *a)
 {
-	int alen;
-	int i, j;
+	size_t alen, i, j;
 
 	if (a == NULL)
 		return;
@@ -959,7 +958,7 @@ void int_array_sort_unique(int *a)
 
 void int_array_add_unique(int **res, int a)
 {
-	int reslen;
+	size_t reslen, max_size;
 	int *n;
 
 	for (reslen = 0; *res && (*res)[reslen]; reslen++) {
@@ -967,7 +966,8 @@ void int_array_add_unique(int **res, int a)
 			return; /* already in the list */
 	}
 
-	if (reslen > INT_MAX - 2) {
+	max_size = (size_t) -1;
+	if (reslen > max_size - 2) {
 		/* This should not really happen in practice, but if it did,
 		 * something would overflow. Do not try to add the new value;
 		 * instead, make this behave like memory allocation failure to
diff --git a/src/utils/common.h b/src/utils/common.h
index 833469a52..8e5cfe16a 100644
--- a/src/utils/common.h
+++ b/src/utils/common.h
@@ -547,7 +547,7 @@ int freq_range_list_includes(const struct wpa_freq_range_list *list,
 			     unsigned int freq);
 char * freq_range_list_str(const struct wpa_freq_range_list *list);
 
-int int_array_len(const int *a);
+size_t int_array_len(const int *a);
 void int_array_concat(int **res, const int *a);
 void int_array_sort_unique(int *a);
 void int_array_add_unique(int **res, int a);
diff --git a/src/utils/utils_module_tests.c b/src/utils/utils_module_tests.c
index f75d4065d..365f21fb1 100644
--- a/src/utils/utils_module_tests.c
+++ b/src/utils/utils_module_tests.c
@@ -226,7 +226,7 @@ static int int_array_tests(void)
 	int test3[] = { 1, 1, 1, -1, 2, 3, 4, 1, 2, 0 };
 	int test3_res[] = { -1, 1, 2, 3, 4, 0 };
 	int errors = 0;
-	int len;
+	size_t len;
 
 	wpa_printf(MSG_INFO, "int_array tests");
 
-- 
2.47.2