From: Jouni Malinen <quic_jouni@quicinc.com>
Date: Mon, 5 Sep 2022 17:56:49 +0000 (+0300)
Subject: Validate MAC Address KDE length in the parser
X-Git-Tag: hostap_2_11~1734
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cd392151c59b494663e02e0633e3c6d957aef224;p=thirdparty%2Fhostap.git

Validate MAC Address KDE length in the parser

Verify that the MAC Address KDE includes enough data to contain a MAC
address as a part of the parsing function so that each caller would not
need to verify this separately. None of the existing users of this
parser actually needed the MAC address value, so there was not any use
for the length field before. The updated design is more robust for
future uses and gets rid of that unused length field as well.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
---

diff --git a/src/common/wpa_common.c b/src/common/wpa_common.c
index c72467eec..33d9bce39 100644
--- a/src/common/wpa_common.c
+++ b/src/common/wpa_common.c
@@ -3209,11 +3209,10 @@ static int wpa_parse_generic(const u8 *pos, struct wpa_eapol_ie_parse *ie)
 		return 0;
 	}
 
-	if (left > 2 && selector == RSN_KEY_DATA_MAC_ADDR) {
+	if (left >= ETH_ALEN && selector == RSN_KEY_DATA_MAC_ADDR) {
 		ie->mac_addr = p;
-		ie->mac_addr_len = left;
-		wpa_hexdump(MSG_DEBUG, "WPA: MAC Address in EAPOL-Key",
-			    pos, dlen);
+		wpa_printf(MSG_DEBUG, "WPA: MAC Address in EAPOL-Key: " MACSTR,
+			   MAC2STR(ie->mac_addr));
 		return 0;
 	}
 
diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h
index a46b8857a..c01ddaa6b 100644
--- a/src/common/wpa_common.h
+++ b/src/common/wpa_common.h
@@ -573,7 +573,6 @@ struct wpa_eapol_ie_parse {
 	const u8 *gtk;
 	size_t gtk_len;
 	const u8 *mac_addr;
-	size_t mac_addr_len;
 	const u8 *igtk;
 	size_t igtk_len;
 	const u8 *bigtk;