D-Bus(old): Fix removeNetwork and selectNetwork error handling

wpas_dbus_decompose_object_path() may leave the network part NULL on
unexpected path. This resulted in NULL pointer dereference when
processing an invalid removeNetwork or selectNetwork call. Fix this by
explicitly verifying that the network part was included in the object
path.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/dbus/dbus_old_handlers.c b/wpa_supplicant/dbus/dbus_old_handlers.c
index c37f7709d50758ea2801ec1e19c850bbd92e41aa..588042b332e694fed43d45a00a6c62a108f79ce1 100644 (file)
--- a/wpa_supplicant/dbus/dbus_old_handlers.c
+++ b/wpa_supplicant/dbus/dbus_old_handlers.c
@@ -846,7 +846,7 @@ DBusMessage * wpas_dbus_iface_remove_network(DBusMessage *message,
 
        /* Extract the network ID */
        iface = wpas_dbus_decompose_object_path(op, &net_id, NULL);
-       if (iface == NULL) {
+       if (iface == NULL || net_id == NULL) {
                reply = wpas_dbus_new_invalid_network_error(message);
                goto out;
        }
@@ -1102,7 +1102,8 @@ DBusMessage * wpas_dbus_iface_select_network(DBusMessage *message,
                        goto out;
                }
                /* Ensure the object path really points to this interface */
-               if (os_strcmp(iface_obj_path, wpa_s->dbus_path) != 0) {
+               if (network == NULL ||
+                   os_strcmp(iface_obj_path, wpa_s->dbus_path) != 0) {
                        reply = wpas_dbus_new_invalid_network_error(message);
                        goto out;
                }