From 8f4636e41c621b1a930b43614eda7825a3f20c2f Mon Sep 17 00:00:00 2001 From: Masashi Honma Date: Mon, 2 Jul 2012 20:53:46 +0300 Subject: [PATCH] P2P: Check memory allocation result in a Service Discovery Response This patch adds a check of the return value of wpabuf_dup() in a large Service Discovery Response. Signed-hostap: Masashi Honma --- src/p2p/p2p_sd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/p2p/p2p_sd.c b/src/p2p/p2p_sd.c index 1a572101b..5cf1cfe6b 100644 --- a/src/p2p/p2p_sd.c +++ b/src/p2p/p2p_sd.c @@ -364,9 +364,14 @@ void p2p_sd_response(struct p2p_data *p2p, int freq, const u8 *dst, "previous SD response"); wpabuf_free(p2p->sd_resp); } + p2p->sd_resp = wpabuf_dup(resp_tlvs); + if (p2p->sd_resp == NULL) { + wpa_msg(p2p->cfg->msg_ctx, MSG_ERROR, "P2P: Failed to " + "allocate SD response fragmentation area"); + return; + } os_memcpy(p2p->sd_resp_addr, dst, ETH_ALEN); p2p->sd_resp_dialog_token = dialog_token; - p2p->sd_resp = wpabuf_dup(resp_tlvs); p2p->sd_resp_pos = 0; p2p->sd_frag_id = 0; resp = p2p_build_sd_response(dialog_token, WLAN_STATUS_SUCCESS,