From: Masashi Honma <masashi.honma@gmail.com>
Date: Mon, 2 Jul 2012 17:53:46 +0000 (+0300)
Subject: P2P: Check memory allocation result in a Service Discovery Response
X-Git-Tag: hostap_2_0~550
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8f4636e41c621b1a930b43614eda7825a3f20c2f;p=thirdparty%2Fhostap.git

P2P: Check memory allocation result in a Service Discovery Response

This patch adds a check of the return value of wpabuf_dup() in a large
Service Discovery Response.

Signed-hostap: Masashi Honma <masashi.honma@gmail.com>
---

diff --git a/src/p2p/p2p_sd.c b/src/p2p/p2p_sd.c
index 1a572101b..5cf1cfe6b 100644
--- a/src/p2p/p2p_sd.c
+++ b/src/p2p/p2p_sd.c
@@ -364,9 +364,14 @@ void p2p_sd_response(struct p2p_data *p2p, int freq, const u8 *dst,
 				"previous SD response");
 			wpabuf_free(p2p->sd_resp);
 		}
+		p2p->sd_resp = wpabuf_dup(resp_tlvs);
+		if (p2p->sd_resp == NULL) {
+			wpa_msg(p2p->cfg->msg_ctx, MSG_ERROR, "P2P: Failed to "
+				"allocate SD response fragmentation area");
+			return;
+		}
 		os_memcpy(p2p->sd_resp_addr, dst, ETH_ALEN);
 		p2p->sd_resp_dialog_token = dialog_token;
-		p2p->sd_resp = wpabuf_dup(resp_tlvs);
 		p2p->sd_resp_pos = 0;
 		p2p->sd_frag_id = 0;
 		resp = p2p_build_sd_response(dialog_token, WLAN_STATUS_SUCCESS,