DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

mka: Avoid reading past the end of mka_body_handler

Browse source 
body_type, used to index in mka_body_handler, can be any u8 value, but
we have only ARRAY_SIZE(mka_body_handler) elements.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
This commit is contained in:
Sabrina Dubroca 2016-07-19 11:56:56 +02:00 committed by Jouni Malinen
parent 65b47738e8
commit ad19e71e68
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/pae/ieee802_1x_kay.c
View file

@ -3057,7 +3057,8 @@ static int ieee802_1x_kay_decode_mkpdu(struct ieee802_1x_kay *kay,
goto next_para_set; goto next_para_set;
handled[body_type] = TRUE; handled[body_type] = TRUE;
if (mak_body_handler[body_type].body_rx) { if (body_type < ARRAY_SIZE(mak_body_handler) &&
mak_body_handler[body_type].body_rx) {
mak_body_handler[body_type].body_rx mak_body_handler[body_type].body_rx
(participant, pos, left_len); (participant, pos, left_len);
} else { } else {