]> git.ipfire.org Git - thirdparty/openwrt.git/commitdiff
hostapd: ubus: fix beacon request buffer overflow with reporting detail
authorFelix Fietkau <nbd@nbd.name>
Wed, 18 Mar 2026 15:58:37 +0000 (15:58 +0000)
committerFelix Fietkau <nbd@nbd.name>
Thu, 19 Mar 2026 09:51:28 +0000 (10:51 +0100)
The reporting detail subelement (up to 3 bytes) was not accounted for
in the wpabuf allocation, causing a crash when reporting_detail is set
to a valid value (0, 1, or 2).

Signed-off-by: Felix Fietkau <nbd@nbd.name>
package/network/services/hostapd/src/src/ap/ubus.c

index 247230a243fa847de4a989d5aaadfa37dd0bbf4d..1a5b29ed9ae1acce558ab0c9822d81197b09d9c4 100644 (file)
@@ -1212,6 +1212,9 @@ hostapd_rrm_beacon_req(struct ubus_context *ctx, struct ubus_object *obj,
        if (tb[BEACON_REQ_REPORTING_DETAIL])
                reporting_detail = blobmsg_get_u32(tb[BEACON_REQ_REPORTING_DETAIL]);
 
+       if (reporting_detail >= 0 && reporting_detail < 3)
+               buf_len += 3;
+
        req = wpabuf_alloc(buf_len);
        if (!req)
                return UBUS_STATUS_UNKNOWN_ERROR;