From: Jouni Malinen Date: Sat, 27 Dec 2014 20:50:17 +0000 (+0200) Subject: D-Bus(old): Fix removeNetwork and selectNetwork error handling X-Git-Tag: hostap_2_4~636 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=62856ad9899351598851b839fd3e5a4e3e7304b2;p=thirdparty%2Fhostap.git D-Bus(old): Fix removeNetwork and selectNetwork error handling wpas_dbus_decompose_object_path() may leave the network part NULL on unexpected path. This resulted in NULL pointer dereference when processing an invalid removeNetwork or selectNetwork call. Fix this by explicitly verifying that the network part was included in the object path. Signed-off-by: Jouni Malinen --- diff --git a/wpa_supplicant/dbus/dbus_old_handlers.c b/wpa_supplicant/dbus/dbus_old_handlers.c index c37f7709d..588042b33 100644 --- a/wpa_supplicant/dbus/dbus_old_handlers.c +++ b/wpa_supplicant/dbus/dbus_old_handlers.c @@ -846,7 +846,7 @@ DBusMessage * wpas_dbus_iface_remove_network(DBusMessage *message, /* Extract the network ID */ iface = wpas_dbus_decompose_object_path(op, &net_id, NULL); - if (iface == NULL) { + if (iface == NULL || net_id == NULL) { reply = wpas_dbus_new_invalid_network_error(message); goto out; } @@ -1102,7 +1102,8 @@ DBusMessage * wpas_dbus_iface_select_network(DBusMessage *message, goto out; } /* Ensure the object path really points to this interface */ - if (os_strcmp(iface_obj_path, wpa_s->dbus_path) != 0) { + if (network == NULL || + os_strcmp(iface_obj_path, wpa_s->dbus_path) != 0) { reply = wpas_dbus_new_invalid_network_error(message); goto out; }