From: Jouni Malinen Date: Thu, 1 Jan 2015 16:04:05 +0000 (+0200) Subject: D-Bus: Fix GroupAdd, Invite, RemovePersistentGroup path validation X-Git-Tag: hostap_2_4~593 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bba40b65b048530d32fcad366e2c3685dfd9f4de;p=thirdparty%2Fhostap.git D-Bus: Fix GroupAdd, Invite, RemovePersistentGroup path validation net_id_str can be NULL and that must be checked for to avoid NULL pointer dereference if an invalid persistent_group_object path is used with these methods. Signed-off-by: Jouni Malinen --- diff --git a/wpa_supplicant/dbus/dbus_new_handlers_p2p.c b/wpa_supplicant/dbus/dbus_new_handlers_p2p.c index c6a36cc5f..2f364e8b8 100644 --- a/wpa_supplicant/dbus/dbus_new_handlers_p2p.c +++ b/wpa_supplicant/dbus/dbus_new_handlers_p2p.c @@ -353,7 +353,7 @@ DBusMessage * wpas_dbus_handler_p2p_group_add(DBusMessage *message, iface = wpas_dbus_new_decompose_object_path( pg_object_path, WPAS_DBUS_NEW_PERSISTENT_GROUPS_PART, &net_id_str); - if (iface == NULL || + if (iface == NULL || net_id_str == NULL || os_strcmp(iface, wpa_s->dbus_new_path) != 0) { reply = wpas_dbus_error_invalid_args(message, @@ -647,7 +647,7 @@ DBusMessage * wpas_dbus_handler_p2p_invite(DBusMessage *message, pg_object_path, WPAS_DBUS_NEW_PERSISTENT_GROUPS_PART, &net_id_str); - if (iface == NULL || + if (iface == NULL || net_id_str == NULL || os_strcmp(iface, wpa_s->dbus_new_path) != 0) { reply = wpas_dbus_error_invalid_args(message, pg_object_path); @@ -1899,7 +1899,8 @@ DBusMessage * wpas_dbus_handler_remove_persistent_group( iface = wpas_dbus_new_decompose_object_path( op, WPAS_DBUS_NEW_PERSISTENT_GROUPS_PART, &persistent_group_id); - if (iface == NULL || os_strcmp(iface, wpa_s->dbus_new_path) != 0) { + if (iface == NULL || persistent_group_id == NULL || + os_strcmp(iface, wpa_s->dbus_new_path) != 0) { reply = wpas_dbus_error_invalid_args(message, op); goto out; }