jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Add sanity checks to EVENT_RX_PROBE_REQ event data

Browse source 
Both the SA and IEs from the received Probe Request frames must be
included and the Probe Request RX callback functions may assume that
these are not NULL.
This commit is contained in:
Jouni Malinen 2011-04-14 02:39:25 +03:00 committed by Jouni Malinen
parent 2a522e7192
commit b211f3eb71
2 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/ap/drv_callbacks.c
View file

@ -253,7 +253,9 @@ int hostapd_probe_req_rx(struct hostapd_data *hapd, const u8 *sa,
size_t i; size_t i;
int ret = 0; int ret = 0;
if (sa) if (sa == NULL || ie == NULL)
return -1;
random_add_randomness(sa, ETH_ALEN); random_add_randomness(sa, ETH_ALEN);
for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++) { for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++) {
if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx, if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx,
@ -491,6 +493,9 @@ void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
break; break;
#endif /* NEED_AP_MLME */ #endif /* NEED_AP_MLME */
case EVENT_RX_PROBE_REQ: case EVENT_RX_PROBE_REQ:
if (data->rx_probe_req.sa == NULL ||
data->rx_probe_req.ie == NULL)
break;
hostapd_probe_req_rx(hapd, data->rx_probe_req.sa, hostapd_probe_req_rx(hapd, data->rx_probe_req.sa,
data->rx_probe_req.ie, data->rx_probe_req.ie,
data->rx_probe_req.ie_len); data->rx_probe_req.ie_len);

3
wpa_supplicant/events.c
View file

@ -2012,6 +2012,9 @@ void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
#endif /* CONFIG_P2P */ #endif /* CONFIG_P2P */
break; break;
case EVENT_RX_PROBE_REQ: case EVENT_RX_PROBE_REQ:
if (data->rx_probe_req.sa == NULL ||
data->rx_probe_req.ie == NULL)
break;
#ifdef CONFIG_AP #ifdef CONFIG_AP
if (wpa_s->ap_iface) { if (wpa_s->ap_iface) {
hostapd_probe_req_rx(wpa_s->ap_iface->bss[0], hostapd_probe_req_rx(wpa_s->ap_iface->bss[0],