DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Move SA Query frame length check to the shared handler function

Browse source 
Check the length in the common handler functions instead of both
callers.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2019-03-09 12:40:05 +02:00
parent 002edb6303
commit 700b3f395e
3 changed files with 12 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/ap/ieee802_11_shared.c
View file

@ -213,6 +213,14 @@ void ieee802_11_sa_query_action(struct hostapd_data *hapd,
const u8 action_type = mgmt->u.action.u.sa_query_resp.action;
const u8 *trans_id = mgmt->u.action.u.sa_query_resp.trans_id;
if (((const u8 *) mgmt) + len <
mgmt->u.action.u.sa_query_resp.variable) {
wpa_printf(MSG_DEBUG,
"IEEE 802.11: Too short SA Query Action frame (len=%lu)",
(unsigned long) len);
return;
}
sta = ap_get_sta(hapd, sa);
#ifdef CONFIG_OCV