jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Check hostapd current_mode before dereferencing it in additional places

Browse source 
While most places using this should be for cases where the hw_features
functionality is required, there seem to be some paths that are getting
exposed in new OWE related operations where that might not be the case.
Add explicit NULL pointer checks to avoid dereferencing the pointer if
it is not set when operating with driver wrappers that do not provide
sufficient information.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Ashok Kumar Ponnaiah 2017-10-30 23:17:05 +02:00 committed by Jouni Malinen
parent 41d5af5544
commit 28d1264131
2 changed files with 10 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/ap/ieee802_11.c
View file

@ -3208,7 +3208,8 @@ static void handle_assoc(struct hostapd_data *hapd,
sta->listen_interval = listen_interval; sta->listen_interval = listen_interval;
if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G) if (hapd->iface->current_mode &&
hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G)
sta->flags |= WLAN_STA_NONERP; sta->flags |= WLAN_STA_NONERP;
for (i = 0; i < sta->supported_rates_len; i++) { for (i = 0; i < sta->supported_rates_len; i++) {
if ((sta->supported_rates[i] & 0x7f) > 22) { if ((sta->supported_rates[i] & 0x7f) > 22) {
@ -3227,7 +3228,8 @@ static void handle_assoc(struct hostapd_data *hapd,
!sta->no_short_slot_time_set) { !sta->no_short_slot_time_set) {
sta->no_short_slot_time_set = 1; sta->no_short_slot_time_set = 1;
hapd->iface->num_sta_no_short_slot_time++; hapd->iface->num_sta_no_short_slot_time++;
if (hapd->iface->current_mode->mode == if (hapd->iface->current_mode &&
hapd->iface->current_mode->mode ==
HOSTAPD_MODE_IEEE80211G && HOSTAPD_MODE_IEEE80211G &&
hapd->iface->num_sta_no_short_slot_time == 1) hapd->iface->num_sta_no_short_slot_time == 1)
ieee802_11_set_beacons(hapd->iface); ieee802_11_set_beacons(hapd->iface);
@ -3242,7 +3244,8 @@ static void handle_assoc(struct hostapd_data *hapd,
!sta->no_short_preamble_set) { !sta->no_short_preamble_set) {
sta->no_short_preamble_set = 1; sta->no_short_preamble_set = 1;
hapd->iface->num_sta_no_short_preamble++; hapd->iface->num_sta_no_short_preamble++;
if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G if (hapd->iface->current_mode &&
hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
&& hapd->iface->num_sta_no_short_preamble == 1) && hapd->iface->num_sta_no_short_preamble == 1)
ieee802_11_set_beacons(hapd->iface); ieee802_11_set_beacons(hapd->iface);
} }

6
src/ap/sta_info.c
View file

@ -197,7 +197,8 @@ void ap_free_sta(struct hostapd_data *hapd, struct sta_info *sta)
if (sta->no_short_slot_time_set) { if (sta->no_short_slot_time_set) {
sta->no_short_slot_time_set = 0; sta->no_short_slot_time_set = 0;
hapd->iface->num_sta_no_short_slot_time--; hapd->iface->num_sta_no_short_slot_time--;
if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G if (hapd->iface->current_mode &&
hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
&& hapd->iface->num_sta_no_short_slot_time == 0) && hapd->iface->num_sta_no_short_slot_time == 0)
set_beacon++; set_beacon++;
} }
@ -205,7 +206,8 @@ void ap_free_sta(struct hostapd_data *hapd, struct sta_info *sta)
if (sta->no_short_preamble_set) { if (sta->no_short_preamble_set) {
sta->no_short_preamble_set = 0; sta->no_short_preamble_set = 0;
hapd->iface->num_sta_no_short_preamble--; hapd->iface->num_sta_no_short_preamble--;
if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G if (hapd->iface->current_mode &&
hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
&& hapd->iface->num_sta_no_short_preamble == 0) && hapd->iface->num_sta_no_short_preamble == 0)
set_beacon++; set_beacon++;
} }