Re: [PATCH v2 1/7] Fix invalid memory access when EIR field length is zero

[Johan Hedberg <johan.hedberg@gmail.com>]

Hi Luiz,

On Thu, Nov 11, 2010, Luiz Augusto von Dentz wrote:
> >        while (len < EIR_DATA_LENGTH - 1) {
> > -               uint8_t type = eir_data[1];
> >                uint8_t field_len = eir_data[0];
> >
> >                /* Check for the end of EIR */
> >                if (field_len == 0)
> >                        break;
> >
> > -               switch (type) {
> > +               switch (eir_data[1]) {
> >                case EIR_UUID16_SOME:
> >                case EIR_UUID16_ALL:
> >                        uuid16_count = field_len / 2;
> 
> IMO type is easier to understand here, we just need to initialize it
> latter after the length check.

True, however I wasn't bothered enough about this and went ahead and
pushed the patch anyway upstream. If someone feels like it, feel free to
reintroduce the variable ;)

Johan