jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

WPS: Fix Probe Request processing to handle missing attribute

Browse source 
WPS IE parsing for PBC mode did not check whether the UUID-E attribute
was included before dereferencing the pointer. This could result in the
AP crashing when processing and invalid Probe Request frame.
This commit is contained in:
Jouni Malinen 2010-01-01 23:38:51 +02:00
parent 2ea856aab6
commit dc5a08c053
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/wps/wps_registrar.c
View file

@ -799,6 +799,11 @@ void wps_registrar_probe_req_rx(struct wps_registrar *reg, const u8 *addr,
wpa_printf(MSG_DEBUG, "WPS: Probe Request for PBC received from " wpa_printf(MSG_DEBUG, "WPS: Probe Request for PBC received from "
MACSTR, MAC2STR(addr)); MACSTR, MAC2STR(addr));
if (attr.uuid_e == NULL) {
wpa_printf(MSG_DEBUG, "WPS: Invalid Probe Request WPS IE: No "
"UUID-E included");
return;
}
wps_registrar_add_pbc_session(reg, addr, attr.uuid_e); wps_registrar_add_pbc_session(reg, addr, attr.uuid_e);
if (wps_registrar_pbc_overlap(reg, addr, attr.uuid_e)) { if (wps_registrar_pbc_overlap(reg, addr, attr.uuid_e)) {