From: Brian Norris <briannorris@chromium.org>
Date: Wed, 19 Aug 2020 19:44:46 +0000 (-0700)
Subject: wlantest: Avoid heap-overflow on unexpected data
X-Git-Tag: hostap_2_10~987
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=22c06de911dfa3e3459817f87f19722d04386819;p=thirdparty%2Fhostap.git

wlantest: Avoid heap-overflow on unexpected data

We're doing a sort of bounds check, based on the previous loop, but only
after we've already tried to read off the end.

This squashes some ASAN errors I'm seeing when running the ap_ft hwsim
test module.

Signed-off-by: Brian Norris <briannorris@chromium.org>
---

diff --git a/wlantest/rx_eapol.c b/wlantest/rx_eapol.c
index d75ed92ba..44388fdda 100644
--- a/wlantest/rx_eapol.c
+++ b/wlantest/rx_eapol.c
@@ -722,8 +722,8 @@ static void rx_data_eapol_key_3_of_4(struct wlantest *wt, const u8 *dst,
 			}
 			p += 2 + p[1];
 		}
-		if (p && p > decrypted && *p == 0xdd &&
-		    p + 1 == decrypted + decrypted_len) {
+		if (p && p > decrypted && p + 1 == decrypted + decrypted_len &&
+		    *p == 0xdd) {
 			/* Remove padding */
 			p--;
 			plain_len = p - decrypted;