From 2982e50c152bf1f4145059dc4c492ebf13a3cdad Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sun, 8 May 2022 16:53:38 +0300 Subject: [PATCH] EAP-SAKA: Simplify attribute parser for static analyzers Make bounds checking in eap_sake_parse_attributes() easier to analyze. Signed-off-by: Jouni Malinen --- src/eap_common/eap_sake_common.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/src/eap_common/eap_sake_common.c b/src/eap_common/eap_sake_common.c index 8ee9e32e1..a4256e2a7 100644 --- a/src/eap_common/eap_sake_common.c +++ b/src/eap_common/eap_sake_common.c @@ -164,26 +164,33 @@ int eap_sake_parse_attributes(const u8 *buf, size_t len, os_memset(attr, 0, sizeof(*attr)); while (pos < end) { + u8 attr_id, attr_len; + if (end - pos < 2) { wpa_printf(MSG_DEBUG, "EAP-SAKE: Too short attribute"); return -1; } - if (pos[1] < 2) { - wpa_printf(MSG_DEBUG, "EAP-SAKE: Invalid attribute " - "length (%d)", pos[1]); + attr_id = *pos++; + attr_len = *pos++; + /* Attribute length value includes the Type and Length fields */ + if (attr_len < 2) { + wpa_printf(MSG_DEBUG, + "EAP-SAKE: Invalid attribute length (%d)", + attr_len); return -1; } + attr_len -= 2; - if (pos + pos[1] > end) { + if (attr_len > end - pos) { wpa_printf(MSG_DEBUG, "EAP-SAKE: Attribute underflow"); return -1; } - if (eap_sake_parse_add_attr(attr, pos[0], pos[1] - 2, pos + 2)) + if (eap_sake_parse_add_attr(attr, attr_id, attr_len, pos)) return -1; - pos += pos[1]; + pos += attr_len; } return 0;