DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

tests: Fix fuzzing tester for WNM

Browse source 
Processing of WNM frames can results in a lookup of the current BSS
table. As such, the testing tool needs to initialize the BSS table to
avoid NULL pointer dereferences. This is not an issue that would show up
with real production uses with wpa_supplicant since wpa_bss_init() is
called there.

Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67244
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This commit is contained in:
Jouni Malinen 2024-03-06 17:36:10 +02:00 committed by Jouni Malinen
parent 40d5fecac2
commit 0a321d1733
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
tests/fuzzing/wnm/wnm.c
View file

@ -53,6 +53,8 @@ static int init_wpa(struct arg_ctx *ctx)
ctx->wpa_s.driver = &ctx->driver;
ctx->wpa_s.wpa = &ctx->wpa;
ctx->wpa_s.conf = &ctx->conf;
if (wpa_bss_init(&ctx->wpa_s) < 0)
return -1;
return 0;
}
@ -61,6 +63,7 @@ static int init_wpa(struct arg_ctx *ctx)
static void deinit_wpa(struct arg_ctx *ctx)
{
wnm_btm_reset(&ctx->wpa_s);
wpa_bss_flush(&ctx->wpa_s);
}