From 745ef1847801c56041a5a33af892827c63e02163 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Mon, 30 Jun 2014 00:32:12 +0300 Subject: [PATCH] HS 2.0: Verify assoc_req_ie buffer size for indication elements While the buffer is expected to be large enough for all the IEs, it is better to check for this explicitly when adding the HS 2.0 Indication element. (CID 68601) Signed-off-by: Jouni Malinen --- wpa_supplicant/sme.c | 14 ++++++++++---- wpa_supplicant/wpa_supplicant.c | 11 ++++++++--- 2 files changed, 18 insertions(+), 7 deletions(-) diff --git a/wpa_supplicant/sme.c b/wpa_supplicant/sme.c index 1b0439841..5188b9f23 100644 --- a/wpa_supplicant/sme.c +++ b/wpa_supplicant/sme.c @@ -361,11 +361,17 @@ static void sme_send_authentication(struct wpa_supplicant *wpa_s, hs20 = wpabuf_alloc(20); if (hs20) { int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid); + size_t len; + wpas_hs20_add_indication(hs20, pps_mo_id); - os_memcpy(wpa_s->sme.assoc_req_ie + - wpa_s->sme.assoc_req_ie_len, - wpabuf_head(hs20), wpabuf_len(hs20)); - wpa_s->sme.assoc_req_ie_len += wpabuf_len(hs20); + len = sizeof(wpa_s->sme.assoc_req_ie) - + wpa_s->sme.assoc_req_ie_len; + if (wpabuf_len(hs20) <= len) { + os_memcpy(wpa_s->sme.assoc_req_ie + + wpa_s->sme.assoc_req_ie_len, + wpabuf_head(hs20), wpabuf_len(hs20)); + wpa_s->sme.assoc_req_ie_len += wpabuf_len(hs20); + } wpabuf_free(hs20); } } diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c index 28d763ca0..0afc9ab8c 100644 --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c @@ -1656,10 +1656,15 @@ static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit) hs20 = wpabuf_alloc(20); if (hs20) { int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid); + size_t len; + wpas_hs20_add_indication(hs20, pps_mo_id); - os_memcpy(wpa_ie + wpa_ie_len, wpabuf_head(hs20), - wpabuf_len(hs20)); - wpa_ie_len += wpabuf_len(hs20); + len = sizeof(wpa_ie) - wpa_ie_len; + if (wpabuf_len(hs20) <= len) { + os_memcpy(wpa_ie + wpa_ie_len, + wpabuf_head(hs20), wpabuf_len(hs20)); + wpa_ie_len += wpabuf_len(hs20); + } wpabuf_free(hs20); } }