DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

WFD: Explicit limit for subelement length (CID 68127)

Browse source 
This adds an explicit limit for the maximum Wi-Fi Display subelement
length for ASCII hexdump. This would not really be needed since the
buffer is already limited by maximum frame length. Anyway, since this
can make static analyzers happier and the subelement used with this
function is short, we may as well include an explicit check.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2014-06-30 00:43:28 +03:00
parent 745ef18478
commit d3fa2bbb02
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
wpa_supplicant/wifi_display.c
View file

@ -280,6 +280,16 @@ char * wifi_display_subelem_hex(const struct wpabuf *wfd_subelems, u8 id)
break; /* truncated subelement */ break; /* truncated subelement */
if (buf[i] == id) { if (buf[i] == id) {
/*
* Limit explicitly to an arbitrary length to avoid
* unnecessarily large allocations. In practice, this
* is limited to maximum frame length anyway, so the
* maximum memory allocation here is not really that
* large. Anyway, the Wi-Fi Display subelements that
* are fetched with this function are even shorter.
*/
if (elen > 1000)
break;
subelem = os_zalloc(2 * elen + 1); subelem = os_zalloc(2 * elen + 1);
if (!subelem) if (!subelem)
return NULL; return NULL;