jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

wext: Avoid undefined behavior in pointer arithmetic

Browse source 
Reorder terms in a way that no invalid pointers are generated with
pos+len operations. end-pos is always defined (with a valid pos pointer)
while pos+len could end up pointing beyond the end pointer which would
be undefined behavior.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2015-10-18 19:08:17 +03:00
parent 336869f05a
commit 45a283e6d0
1 changed files with 15 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
src/drivers/driver_wext.c
View file

@ -422,7 +422,7 @@ static void wpa_driver_wext_event_assoc_ies(struct wpa_driver_wext_data *drv)
static void wpa_driver_wext_event_wireless(struct wpa_driver_wext_data *drv, static void wpa_driver_wext_event_wireless(struct wpa_driver_wext_data *drv,
char *data, int len) char *data, unsigned int len)
{ {
struct iw_event iwe_buf, *iwe = &iwe_buf; struct iw_event iwe_buf, *iwe = &iwe_buf;
char *pos, *end, *custom, *buf; char *pos, *end, *custom, *buf;
@ -430,13 +430,13 @@ static void wpa_driver_wext_event_wireless(struct wpa_driver_wext_data *drv,
pos = data; pos = data;
end = data + len; end = data + len;
while (pos + IW_EV_LCP_LEN <= end) { while ((size_t) (end - pos) >= IW_EV_LCP_LEN) {
/* Event data may be unaligned, so make a local, aligned copy /* Event data may be unaligned, so make a local, aligned copy
* before processing. */ * before processing. */
os_memcpy(&iwe_buf, pos, IW_EV_LCP_LEN); os_memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
wpa_printf(MSG_DEBUG, "Wireless event: cmd=0x%x len=%d", wpa_printf(MSG_DEBUG, "Wireless event: cmd=0x%x len=%d",
iwe->cmd, iwe->len); iwe->cmd, iwe->len);
if (iwe->len <= IW_EV_LCP_LEN) if (iwe->len <= IW_EV_LCP_LEN || iwe->len > end - pos)
return; return;
custom = pos + IW_EV_POINT_LEN; custom = pos + IW_EV_POINT_LEN;
@ -480,7 +480,7 @@ static void wpa_driver_wext_event_wireless(struct wpa_driver_wext_data *drv,
} }
break; break;
case IWEVMICHAELMICFAILURE: case IWEVMICHAELMICFAILURE:
if (custom + iwe->u.data.length > end) { if (iwe->u.data.length > end - custom) {
wpa_printf(MSG_DEBUG, "WEXT: Invalid " wpa_printf(MSG_DEBUG, "WEXT: Invalid "
"IWEVMICHAELMICFAILURE length"); "IWEVMICHAELMICFAILURE length");
return; return;
@ -489,7 +489,7 @@ static void wpa_driver_wext_event_wireless(struct wpa_driver_wext_data *drv,
drv->ctx, custom, iwe->u.data.length); drv->ctx, custom, iwe->u.data.length);
break; break;
case IWEVCUSTOM: case IWEVCUSTOM:
if (custom + iwe->u.data.length > end) { if (iwe->u.data.length > end - custom) {
wpa_printf(MSG_DEBUG, "WEXT: Invalid " wpa_printf(MSG_DEBUG, "WEXT: Invalid "
"IWEVCUSTOM length"); "IWEVCUSTOM length");
return; return;
@ -508,7 +508,7 @@ static void wpa_driver_wext_event_wireless(struct wpa_driver_wext_data *drv,
NULL); NULL);
break; break;
case IWEVASSOCREQIE: case IWEVASSOCREQIE:
if (custom + iwe->u.data.length > end) { if (iwe->u.data.length > end - custom) {
wpa_printf(MSG_DEBUG, "WEXT: Invalid " wpa_printf(MSG_DEBUG, "WEXT: Invalid "
"IWEVASSOCREQIE length"); "IWEVASSOCREQIE length");
return; return;
@ -517,7 +517,7 @@ static void wpa_driver_wext_event_wireless(struct wpa_driver_wext_data *drv,
drv, custom, iwe->u.data.length); drv, custom, iwe->u.data.length);
break; break;
case IWEVASSOCRESPIE: case IWEVASSOCRESPIE:
if (custom + iwe->u.data.length > end) { if (iwe->u.data.length > end - custom) {
wpa_printf(MSG_DEBUG, "WEXT: Invalid " wpa_printf(MSG_DEBUG, "WEXT: Invalid "
"IWEVASSOCRESPIE length"); "IWEVASSOCRESPIE length");
return; return;
@ -526,7 +526,7 @@ static void wpa_driver_wext_event_wireless(struct wpa_driver_wext_data *drv,
drv, custom, iwe->u.data.length); drv, custom, iwe->u.data.length);
break; break;
case IWEVPMKIDCAND: case IWEVPMKIDCAND:
if (custom + iwe->u.data.length > end) { if (iwe->u.data.length > end - custom) {
wpa_printf(MSG_DEBUG, "WEXT: Invalid " wpa_printf(MSG_DEBUG, "WEXT: Invalid "
"IWEVPMKIDCAND length"); "IWEVPMKIDCAND length");
return; return;
@ -1220,7 +1220,7 @@ static void wext_get_scan_ssid(struct iw_event *iwe,
char *end) char *end)
{ {
int ssid_len = iwe->u.essid.length; int ssid_len = iwe->u.essid.length;
if (custom + ssid_len > end) if (ssid_len > end - custom)
return; return;
if (iwe->u.essid.flags && if (iwe->u.essid.flags &&
ssid_len > 0 && ssid_len > 0 &&
@ -1316,7 +1316,7 @@ static void wext_get_scan_rate(struct iw_event *iwe,
size_t clen; size_t clen;
clen = iwe->len; clen = iwe->len;
if (custom + clen > end) if (clen > (size_t) (end - custom))
return; return;
maxrate = 0; maxrate = 0;
while (((ssize_t) clen) >= (ssize_t) sizeof(struct iw_param)) { while (((ssize_t) clen) >= (ssize_t) sizeof(struct iw_param)) {
@ -1369,7 +1369,7 @@ static void wext_get_scan_custom(struct iw_event *iwe,
u8 *tmp; u8 *tmp;
clen = iwe->u.data.length; clen = iwe->u.data.length;
if (custom + clen > end) if (clen > (size_t) (end - custom))
return; return;
if (clen > 7 && os_strncmp(custom, "wpa_ie=", 7) == 0) { if (clen > 7 && os_strncmp(custom, "wpa_ie=", 7) == 0) {
@ -1441,8 +1441,8 @@ static void wpa_driver_wext_add_scan_entry(struct wpa_scan_results *res,
/* Figure out whether we need to fake any IEs */ /* Figure out whether we need to fake any IEs */
pos = data->ie; pos = data->ie;
end = pos + data->ie_len; end = pos + data->ie_len;
while (pos && pos + 1 < end) { while (pos && end - pos > 1) {
if (pos + 2 + pos[1] > end) if (2 + pos[1] > end - pos)
break; break;
if (pos[0] == WLAN_EID_SSID) if (pos[0] == WLAN_EID_SSID)
ssid_ie = pos; ssid_ie = pos;
@ -1530,11 +1530,11 @@ struct wpa_scan_results * wpa_driver_wext_get_scan_results(void *priv)
end = (char *) res_buf + len; end = (char *) res_buf + len;
os_memset(&data, 0, sizeof(data)); os_memset(&data, 0, sizeof(data));
while (pos + IW_EV_LCP_LEN <= end) { while ((size_t) (end - pos) >= IW_EV_LCP_LEN) {
/* Event data may be unaligned, so make a local, aligned copy /* Event data may be unaligned, so make a local, aligned copy
* before processing. */ * before processing. */
os_memcpy(&iwe_buf, pos, IW_EV_LCP_LEN); os_memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
if (iwe->len <= IW_EV_LCP_LEN) if (iwe->len <= IW_EV_LCP_LEN || iwe->len > end - pos)
break; break;
custom = pos + IW_EV_POINT_LEN; custom = pos + IW_EV_POINT_LEN;