DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

P2P: Fix a corner case in peer addition based on PD Request

Browse source 
p2p_add_device() may remove the oldest entry if there is no room in the
peer table for a new peer. This would result in any pointer to that
removed entry becoming stale. A corner case with an invalid PD Request
frame could result in such a case ending up using (read+write) freed
memory. This could only by triggered when the peer table has reached its
maximum size and the PD Request frame is received from the P2P Device
Address of the oldest remaining entry and the frame has incorrect P2P
Device Address in the payload.

Fix this by fetching the dev pointer again after having called
p2p_add_device() so that the stale pointer cannot be used.

Fixes: 17bef1e97a ("P2P: Add peer entry based on Provision Discovery Request")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit is contained in:
Jouni Malinen 2020-12-08 23:52:50 +02:00 committed by Jouni Malinen
parent 59e9794c7d
commit 8460e32309
1 changed files with 5 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/p2p/p2p_pd.c
View file

@ -595,14 +595,12 @@ void p2p_process_prov_disc_req(struct p2p_data *p2p, const u8 *sa,
goto out; goto out;
} }
dev = p2p_get_device(p2p, sa);
if (!dev) { if (!dev) {
dev = p2p_get_device(p2p, sa); p2p_dbg(p2p,
if (!dev) { "Provision Discovery device not found "
p2p_dbg(p2p, MACSTR, MAC2STR(sa));
"Provision Discovery device not found " goto out;
MACSTR, MAC2STR(sa));
goto out;
}
} }
} else if (msg.wfd_subelems) { } else if (msg.wfd_subelems) {
wpabuf_free(dev->info.wfd_subelems); wpabuf_free(dev->info.wfd_subelems);