DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

hostap: Avoid undefined behavior in pointer arithmetic

Browse source 
Reorder terms in a way that no invalid pointers are generated with
pos+len operations. end-pos is always defined (with a valid pos pointer)
while pos+len could end up pointing beyond the end pointer which would
be undefined behavior.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2015-10-18 19:07:43 +03:00
parent d034f498ce
commit d717126aa2
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/drivers/driver_hostap.c
View file

@ -814,7 +814,7 @@ hostapd_wireless_event_wireless_custom(struct hostap_driver_data *drv,
static void hostapd_wireless_event_wireless(struct hostap_driver_data *drv, static void hostapd_wireless_event_wireless(struct hostap_driver_data *drv,
char *data, int len) char *data, unsigned int len)
{ {
struct iw_event iwe_buf, *iwe = &iwe_buf; struct iw_event iwe_buf, *iwe = &iwe_buf;
char *pos, *end, *custom, *buf; char *pos, *end, *custom, *buf;
@ -822,13 +822,13 @@ static void hostapd_wireless_event_wireless(struct hostap_driver_data *drv,
pos = data; pos = data;
end = data + len; end = data + len;
while (pos + IW_EV_LCP_LEN <= end) { while ((size_t) (end - pos) >= IW_EV_LCP_LEN) {
/* Event data may be unaligned, so make a local, aligned copy /* Event data may be unaligned, so make a local, aligned copy
* before processing. */ * before processing. */
memcpy(&iwe_buf, pos, IW_EV_LCP_LEN); memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
wpa_printf(MSG_DEBUG, "Wireless event: cmd=0x%x len=%d", wpa_printf(MSG_DEBUG, "Wireless event: cmd=0x%x len=%d",
iwe->cmd, iwe->len); iwe->cmd, iwe->len);
if (iwe->len <= IW_EV_LCP_LEN) if (iwe->len <= IW_EV_LCP_LEN || iwe->len > end - pos)
return; return;
custom = pos + IW_EV_POINT_LEN; custom = pos + IW_EV_POINT_LEN;
@ -847,7 +847,7 @@ static void hostapd_wireless_event_wireless(struct hostap_driver_data *drv,
switch (iwe->cmd) { switch (iwe->cmd) {
case IWEVCUSTOM: case IWEVCUSTOM:
if (custom + iwe->u.data.length > end) if (iwe->u.data.length > end - custom)
return; return;
buf = malloc(iwe->u.data.length + 1); buf = malloc(iwe->u.data.length + 1);
if (buf == NULL) if (buf == NULL)