diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c index 64c805d58..f3d941b75 100644 --- a/wpa_supplicant/ctrl_iface.c +++ b/wpa_supplicant/ctrl_iface.c @@ -2991,6 +2991,9 @@ static int p2p_ctrl_connect(struct wpa_supplicant *wpa_s, char *cmd, } else if (os_strncmp(pos, "pbc", 3) == 0) { wps_method = WPS_PBC; } else { + char *end; + long int val; + pin = pos; pos = os_strchr(pin, ' '); wps_method = WPS_PIN_KEYPAD; @@ -2999,6 +3002,12 @@ static int p2p_ctrl_connect(struct wpa_supplicant *wpa_s, char *cmd, if (os_strncmp(pos, "display", 7) == 0) wps_method = WPS_PIN_DISPLAY; } + val = strtol(pin, &end, 10); + if (val < 0 || (os_strlen(pin) != 4 && os_strlen(pin) != 8) || + *end != '\0') { + os_memcpy(buf, "FAIL-INVALID-PIN\n", 17); + return 17; + } } new_pin = wpas_p2p_connect(wpa_s, addr, pin, wps_method,