DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

P2P: Fix a theoretical out of bounds read in wpas_p2p_select_go_freq()

Browse source 
Commit 8e84921efe ('P2P: Support driver
preferred freq list for Autonomous GO case') introduced this loop to go
through preferred channel list from the driver. The loop does bounds
checking of the index only after having read a value from the array.
That could in theory read one entry beyond the end of the stack buffer.

Fix this by moving the index variable check to be done before using it
to fetch a value from the array.

This code is used only if wpa_supplicant is build with
CONFIG_DRIVER_NL80211_QCA=y and if the driver supports the vendor
extension (get_pref_freq_list() driver op). In addition, the driver
would need to return more than P2P_MAX_PREF_CHANNELS (= 100) preferred
channels for this to actually be able to read beyond the buffer. No
driver is known to return that many preferred channels, so this does not
seem to be reachable in practice.

Signed-off-by: Amit Purwar <amit.purwar@samsung.com>
Signed-off-by: Mayank Haarit <mayank.h@samsung.com>
This commit is contained in:
Amit Purwar 2016-12-09 18:59:16 +05:30 committed by Jouni Malinen
parent 944d485889
commit f49c852b5e
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
wpa_supplicant/p2p_supplicant.c
View file

@ -5606,9 +5606,9 @@ static int wpas_p2p_select_go_freq(struct wpa_supplicant *wpa_s, int freq)
&size, pref_freq_list); &size, pref_freq_list);
if (!res && size > 0) { if (!res && size > 0) {
i = 0; i = 0;
while (wpas_p2p_disallowed_freq(wpa_s->global, while (i < size &&
pref_freq_list[i]) && wpas_p2p_disallowed_freq(wpa_s->global,
i < size) { pref_freq_list[i])) {
wpa_printf(MSG_DEBUG, wpa_printf(MSG_DEBUG,
"P2P: preferred_freq_list[%d]=%d is disallowed", "P2P: preferred_freq_list[%d]=%d is disallowed",
i, pref_freq_list[i]); i, pref_freq_list[i]);