WNM: Fix neighbor report subelement parser
Only the Neighbor Report element should be included here, so verify that the element id matches. In addition, verify that each subelement has valid length before using the data. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
parent
5583b8d1eb
commit
1aa6f953bb
2 changed files with 15 additions and 5 deletions
|
@ -224,6 +224,7 @@
|
||||||
#define WLAN_EID_QOS 46
|
#define WLAN_EID_QOS 46
|
||||||
#define WLAN_EID_RSN 48
|
#define WLAN_EID_RSN 48
|
||||||
#define WLAN_EID_EXT_SUPP_RATES 50
|
#define WLAN_EID_EXT_SUPP_RATES 50
|
||||||
|
#define WLAN_EID_NEIGHBOR_REPORT 52
|
||||||
#define WLAN_EID_MOBILITY_DOMAIN 54
|
#define WLAN_EID_MOBILITY_DOMAIN 54
|
||||||
#define WLAN_EID_FAST_BSS_TRANSITION 55
|
#define WLAN_EID_FAST_BSS_TRANSITION 55
|
||||||
#define WLAN_EID_TIMEOUT_INTERVAL 56
|
#define WLAN_EID_TIMEOUT_INTERVAL 56
|
||||||
|
|
|
@ -461,8 +461,15 @@ static void wnm_parse_neighbor_report(struct wpa_supplicant *wpa_s,
|
||||||
|
|
||||||
id = *pos++;
|
id = *pos++;
|
||||||
elen = *pos++;
|
elen = *pos++;
|
||||||
|
wpa_printf(MSG_DEBUG, "WNM: Subelement id=%u len=%u", id, elen);
|
||||||
|
left -= 2;
|
||||||
|
if (elen > left) {
|
||||||
|
wpa_printf(MSG_DEBUG,
|
||||||
|
"WNM: Truncated neighbor report subelement");
|
||||||
|
break;
|
||||||
|
}
|
||||||
wnm_parse_neighbor_report_elem(rep, id, elen, pos);
|
wnm_parse_neighbor_report_elem(rep, id, elen, pos);
|
||||||
left -= 2 + elen;
|
left -= elen;
|
||||||
pos += elen;
|
pos += elen;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -695,10 +702,12 @@ static void ieee802_11_rx_bss_trans_mgmt_req(struct wpa_supplicant *wpa_s,
|
||||||
wpa_printf(MSG_DEBUG, "WNM: Truncated request");
|
wpa_printf(MSG_DEBUG, "WNM: Truncated request");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
wnm_parse_neighbor_report(
|
if (tag == WLAN_EID_NEIGHBOR_REPORT) {
|
||||||
wpa_s, pos, len,
|
struct neighbor_report *rep;
|
||||||
&wpa_s->wnm_neighbor_report_elements[
|
rep = &wpa_s->wnm_neighbor_report_elements[
|
||||||
wpa_s->wnm_num_neighbor_report]);
|
wpa_s->wnm_num_neighbor_report];
|
||||||
|
wnm_parse_neighbor_report(wpa_s, pos, len, rep);
|
||||||
|
}
|
||||||
|
|
||||||
pos += len;
|
pos += len;
|
||||||
wpa_s->wnm_num_neighbor_report++;
|
wpa_s->wnm_num_neighbor_report++;
|
||||||
|
|
Loading…
Reference in a new issue