DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Reject ap_vendor_elements if its length is odd

Browse source 
Align the process logic for ap_vendor_elements and ap_assocresp_elements
parsing by using the wpabuf_parse_bin() helper function in both.

Signed-off-by: Chaoli Zhou <zchaoli@codeaurora.org>
This commit is contained in:
Chaoli Zhou 2021-11-19 22:13:29 +08:00 committed by Jouni Malinen
parent 2c2bfebca4
commit 14ab4a816c
1 changed files with 7 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
wpa_supplicant/config.c
View file

@ -4911,33 +4911,21 @@ static int wpa_config_process_ap_vendor_elements(
struct wpa_config *config, int line, const char *pos) struct wpa_config *config, int line, const char *pos)
{ {
struct wpabuf *tmp; struct wpabuf *tmp;
int len = os_strlen(pos) / 2;
u8 *p;
if (!len) { if (!*pos) {
wpabuf_free(config->ap_vendor_elements); wpabuf_free(config->ap_vendor_elements);
config->ap_vendor_elements = NULL; config->ap_vendor_elements = NULL;
return 0; return 0;
} }
tmp = wpabuf_alloc(len); tmp = wpabuf_parse_bin(pos);
if (tmp) { if (!tmp) {
p = wpabuf_put(tmp, len); wpa_printf(MSG_ERROR, "Line %d: invalid ap_vendor_elements",
line);
if (hexstr2bin(pos, p, len)) {
wpa_printf(MSG_ERROR, "Line %d: invalid "
"ap_vendor_elements", line);
wpabuf_free(tmp);
return -1;
}
wpabuf_free(config->ap_vendor_elements);
config->ap_vendor_elements = tmp;
} else {
wpa_printf(MSG_ERROR, "Cannot allocate memory for "
"ap_vendor_elements");
return -1; return -1;
} }
wpabuf_free(config->ap_vendor_elements);
config->ap_vendor_elements = tmp;
return 0; return 0;
} }