From: Brian Norris <briannorris@chromium.org>
Date: Mon, 8 Jun 2020 23:47:53 +0000 (-0700)
Subject: tests: Skip malformed SAE authentication frames
X-Git-Tag: hostap_2_10~1158
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ddd821365a187001555fe572e9910e9975bedeec;p=thirdparty%2Fhostap.git

tests: Skip malformed SAE authentication frames

The parsed 'length' field might pointsbeyond the end of the frame, for
some malformed frames. I haven't figured the source of said packets (I'm
using kernel 4.14.177, FWIW), but we can at least be safer about our
handling of them here.

Signed-off-by: Brian Norris <briannorris@chromium.org>
---

diff --git a/tests/hwsim/test_sae.py b/tests/hwsim/test_sae.py
index ed6ae89dc..3722cd427 100644
--- a/tests/hwsim/test_sae.py
+++ b/tests/hwsim/test_sae.py
@@ -1788,8 +1788,10 @@ def build_sae_commit(bssid, addr, group=21, token=None):
 
 def sae_rx_commit_token_req(sock, radiotap, send_two=False):
     msg = sock.recv(1500)
-    ver, pad, len, present = struct.unpack('<BBHL', msg[0:8])
-    frame = msg[len:]
+    ver, pad, length, present = struct.unpack('<BBHL', msg[0:8])
+    frame = msg[length:]
+    if len(frame) < 4:
+        return False
     fc, duration = struct.unpack('<HH', frame[0:4])
     if fc != 0xb0:
         return False