jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

D-Bus(old): Fix removeNetwork and selectNetwork error handling

Browse source 
wpas_dbus_decompose_object_path() may leave the network part NULL on
unexpected path. This resulted in NULL pointer dereference when
processing an invalid removeNetwork or selectNetwork call. Fix this by
explicitly verifying that the network part was included in the object
path.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2014-12-27 22:50:17 +02:00
parent 84edd136b5
commit 62856ad989
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
wpa_supplicant/dbus/dbus_old_handlers.c
View file

@ -846,7 +846,7 @@ DBusMessage * wpas_dbus_iface_remove_network(DBusMessage *message,
/* Extract the network ID */
iface = wpas_dbus_decompose_object_path(op, &net_id, NULL);
if (iface == NULL) {
if (iface == NULL || net_id == NULL) {
reply = wpas_dbus_new_invalid_network_error(message);
goto out;
}
@ -1102,7 +1102,8 @@ DBusMessage * wpas_dbus_iface_select_network(DBusMessage *message,
goto out;
}
/* Ensure the object path really points to this interface */
if (os_strcmp(iface_obj_path, wpa_s->dbus_path) != 0) {
if (network == NULL ||
os_strcmp(iface_obj_path, wpa_s->dbus_path) != 0) {
reply = wpas_dbus_new_invalid_network_error(message);
goto out;
}