From 62856ad9899351598851b839fd3e5a4e3e7304b2 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sat, 27 Dec 2014 22:50:17 +0200 Subject: [PATCH] D-Bus(old): Fix removeNetwork and selectNetwork error handling wpas_dbus_decompose_object_path() may leave the network part NULL on unexpected path. This resulted in NULL pointer dereference when processing an invalid removeNetwork or selectNetwork call. Fix this by explicitly verifying that the network part was included in the object path. Signed-off-by: Jouni Malinen --- wpa_supplicant/dbus/dbus_old_handlers.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/wpa_supplicant/dbus/dbus_old_handlers.c b/wpa_supplicant/dbus/dbus_old_handlers.c index c37f7709d..588042b33 100644 --- a/wpa_supplicant/dbus/dbus_old_handlers.c +++ b/wpa_supplicant/dbus/dbus_old_handlers.c @@ -846,7 +846,7 @@ DBusMessage * wpas_dbus_iface_remove_network(DBusMessage *message, /* Extract the network ID */ iface = wpas_dbus_decompose_object_path(op, &net_id, NULL); - if (iface == NULL) { + if (iface == NULL || net_id == NULL) { reply = wpas_dbus_new_invalid_network_error(message); goto out; } @@ -1102,7 +1102,8 @@ DBusMessage * wpas_dbus_iface_select_network(DBusMessage *message, goto out; } /* Ensure the object path really points to this interface */ - if (os_strcmp(iface_obj_path, wpa_s->dbus_path) != 0) { + if (network == NULL || + os_strcmp(iface_obj_path, wpa_s->dbus_path) != 0) { reply = wpas_dbus_new_invalid_network_error(message); goto out; }