]> git.ipfire.org Git - thirdparty/hostap.git/commit
P2P: Fix wfd_dev_info parsing for P2P-DEVICE-FOUND (CID 68127)
authorJouni Malinen <j@w1.fi>
Fri, 13 Jun 2014 12:25:39 +0000 (15:25 +0300)
committerJouni Malinen <j@w1.fi>
Fri, 13 Jun 2014 12:25:39 +0000 (15:25 +0300)
commit49d13df63cd9219585b0e05cc9c23bfb9a5aa2f3
tree0e19eb1c79344c99904821f5e68d755aaa859be8
parent1851e17a64eb5efb0b4bc36ffe2aaa5fe7e0abb0
P2P: Fix wfd_dev_info parsing for P2P-DEVICE-FOUND (CID 68127)

Commit b125c48fce823f28d22ebd68297c5b94366c6aa1 ('P2P: Add wfd_dev_info=
field for device found event') added Wi-Fi Display device info to the
P2P-DEVICE-FOUND events. However, it did not include proper bounds
checking in wifi_display_subelem_hex() and could accept subelements with
invalid length field values. This could result in buffer read overflow
of up to 64 kB and inclusion of heap memory in the local control
interface event and/or process crash due to invalid memory access. Fix
this by checking the validity of the length field before writing a
hexdump of the data.

Signed-off-by: Jouni Malinen <j@w1.fi>
wpa_supplicant/wifi_display.c