WNM: Fix neighbor report subelement parser

Only the Neighbor Report element should be included here, so verify that
the element id matches. In addition, verify that each subelement has
valid length before using the data.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/src/common/ieee802_11_defs.h b/src/common/ieee802_11_defs.h
index b426e782c7b1b2025d53340d31fac09160327ba3..cb70130d3fadb7650f294dd1b8cf4b92481da6f1 100644 (file)
--- a/src/common/ieee802_11_defs.h
+++ b/src/common/ieee802_11_defs.h
@@ -224,6 +224,7 @@
 #define WLAN_EID_QOS 46
 #define WLAN_EID_RSN 48
 #define WLAN_EID_EXT_SUPP_RATES 50
+#define WLAN_EID_NEIGHBOR_REPORT 52
 #define WLAN_EID_MOBILITY_DOMAIN 54
 #define WLAN_EID_FAST_BSS_TRANSITION 55
 #define WLAN_EID_TIMEOUT_INTERVAL 56

diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
index 1ca4c71faf77d2b16789d541250d05799b18ab5e..cccc61f3005bbdc4854fff5a36aaa6f6b87049eb 100644 (file)
--- a/wpa_supplicant/wnm_sta.c
+++ b/wpa_supplicant/wnm_sta.c
@@ -461,8 +461,15 @@ static void wnm_parse_neighbor_report(struct wpa_supplicant *wpa_s,
 
                id = *pos++;
                elen = *pos++;
+               wpa_printf(MSG_DEBUG, "WNM: Subelement id=%u len=%u", id, elen);
+               left -= 2;
+               if (elen > left) {
+                       wpa_printf(MSG_DEBUG,
+                                  "WNM: Truncated neighbor report subelement");
+                       break;
+               }
                wnm_parse_neighbor_report_elem(rep, id, elen, pos);
-               left -= 2 + elen;
+               left -= elen;
                pos += elen;
        }
 }
@@ -695,10 +702,12 @@ static void ieee802_11_rx_bss_trans_mgmt_req(struct wpa_supplicant *wpa_s,
                                wpa_printf(MSG_DEBUG, "WNM: Truncated request");
                                return;
                        }
-                       wnm_parse_neighbor_report(
-                               wpa_s, pos, len,
-                               &wpa_s->wnm_neighbor_report_elements[
-                                       wpa_s->wnm_num_neighbor_report]);
+                       if (tag == WLAN_EID_NEIGHBOR_REPORT) {
+                               struct neighbor_report *rep;
+                               rep = &wpa_s->wnm_neighbor_report_elements[
+                                       wpa_s->wnm_num_neighbor_report];
+                               wnm_parse_neighbor_report(wpa_s, pos, len, rep);
+                       }
 
                        pos += len;
                        wpa_s->wnm_num_neighbor_report++;