From: Chaoli Zhou <zchaoli@codeaurora.org>
Date: Fri, 19 Nov 2021 14:13:29 +0000 (+0800)
Subject: Reject ap_vendor_elements if its length is odd
X-Git-Tag: hostap_2_10~54
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=14ab4a816c681bed4a58ad1c6b961b767db65cbe;p=thirdparty%2Fhostap.git

Reject ap_vendor_elements if its length is odd

Align the process logic for ap_vendor_elements and ap_assocresp_elements
parsing by using the wpabuf_parse_bin() helper function in both.

Signed-off-by: Chaoli Zhou <zchaoli@codeaurora.org>
---

diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
index bf97de698..c5177d915 100644
--- a/wpa_supplicant/config.c
+++ b/wpa_supplicant/config.c
@@ -4911,33 +4911,21 @@ static int wpa_config_process_ap_vendor_elements(
 	struct wpa_config *config, int line, const char *pos)
 {
 	struct wpabuf *tmp;
-	int len = os_strlen(pos) / 2;
-	u8 *p;
 
-	if (!len) {
+	if (!*pos) {
 		wpabuf_free(config->ap_vendor_elements);
 		config->ap_vendor_elements = NULL;
 		return 0;
 	}
 
-	tmp = wpabuf_alloc(len);
-	if (tmp) {
-		p = wpabuf_put(tmp, len);
-
-		if (hexstr2bin(pos, p, len)) {
-			wpa_printf(MSG_ERROR, "Line %d: invalid "
-				   "ap_vendor_elements", line);
-			wpabuf_free(tmp);
-			return -1;
-		}
-
-		wpabuf_free(config->ap_vendor_elements);
-		config->ap_vendor_elements = tmp;
-	} else {
-		wpa_printf(MSG_ERROR, "Cannot allocate memory for "
-			   "ap_vendor_elements");
+	tmp = wpabuf_parse_bin(pos);
+	if (!tmp) {
+		wpa_printf(MSG_ERROR, "Line %d: invalid ap_vendor_elements",
+			   line);
 		return -1;
 	}
+	wpabuf_free(config->ap_vendor_elements);
+	config->ap_vendor_elements = tmp;
 
 	return 0;
 }