]> git.ipfire.org Git - thirdparty/hostap.git/commit
Avoid undefined behavior in RSNXE capability bit checker
authorJouni Malinen <quic_jouni@quicinc.com>
Fri, 1 Nov 2024 19:58:07 +0000 (21:58 +0200)
committerJouni Malinen <j@w1.fi>
Fri, 1 Nov 2024 19:58:07 +0000 (21:58 +0200)
commitc2f90ef35ba7c541641ba1d93693f3e989fa5704
tree3289d5da7ac3cd2dd50b320184a734a2544fe25f
parent5ef63562c6bc1c8cb2c374d3a9ea0247ee2de38c
Avoid undefined behavior in RSNXE capability bit checker

Integer promotion converts u8 rsnxe[i] to an int which is not
sufficiently large to be able to handle the maximum shift left of 24
bits here. Type cast rsnxe[i] to u32 explicitly to get rid of the sign
bit and avoid this undefined behavior from the shift operation.

Credit to OSS-Fuzz: https://issues.oss-fuzz.com/issues/376786400
Fixes: d675d3b15b40 ("Add helper functions for parsing RSNXE capabilities")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
src/common/ieee802_11_common.c