aboutsummaryrefslogtreecommitdiffstats
path: root/src/drivers/driver_wext.c
diff options
context:
space:
mode:
authorJouni Malinen <j@w1.fi>2010-01-10 20:26:11 (GMT)
committerJouni Malinen <j@w1.fi>2010-01-10 20:26:11 (GMT)
commit4a5869206e8e5bc4116eb8ef02d242549dc18fcf (patch)
tree34ed13eba916f98fffb1ff11b86d6e7695892618 /src/drivers/driver_wext.c
parenta7efb16052f1ec0b4637447d8f80289d085d606b (diff)
downloadhostap-4a5869206e8e5bc4116eb8ef02d242549dc18fcf.zip
hostap-4a5869206e8e5bc4116eb8ef02d242549dc18fcf.tar.gz
hostap-4a5869206e8e5bc4116eb8ef02d242549dc18fcf.tar.bz2
wext: Check hexstr2bin() return value in custom scan text processing
Diffstat (limited to 'src/drivers/driver_wext.c')
-rw-r--r--src/drivers/driver_wext.c11
1 files changed, 8 insertions, 3 deletions
diff --git a/src/drivers/driver_wext.c b/src/drivers/driver_wext.c
index cb89a9e..3fe1329 100644
--- a/src/drivers/driver_wext.c
+++ b/src/drivers/driver_wext.c
@@ -1133,8 +1133,9 @@ static void wext_get_scan_custom(struct iw_event *iwe,
tmp = os_realloc(res->ie, res->ie_len + bytes);
if (tmp == NULL)
return;
- hexstr2bin(spos, tmp + res->ie_len, bytes);
res->ie = tmp;
+ if (hexstr2bin(spos, tmp + res->ie_len, bytes) < 0)
+ return;
res->ie_len += bytes;
} else if (clen > 7 && os_strncmp(custom, "rsn_ie=", 7) == 0) {
char *spos;
@@ -1147,8 +1148,9 @@ static void wext_get_scan_custom(struct iw_event *iwe,
tmp = os_realloc(res->ie, res->ie_len + bytes);
if (tmp == NULL)
return;
- hexstr2bin(spos, tmp + res->ie_len, bytes);
res->ie = tmp;
+ if (hexstr2bin(spos, tmp + res->ie_len, bytes) < 0)
+ return;
res->ie_len += bytes;
} else if (clen > 4 && os_strncmp(custom, "tsf=", 4) == 0) {
char *spos;
@@ -1161,7 +1163,10 @@ static void wext_get_scan_custom(struct iw_event *iwe,
return;
}
bytes /= 2;
- hexstr2bin(spos, bin, bytes);
+ if (hexstr2bin(spos, bin, bytes) < 0) {
+ wpa_printf(MSG_DEBUG, "WEXT: Invalid TSF value");
+ return;
+ }
res->res.tsf += WPA_GET_BE64(bin);
}
}