aboutsummaryrefslogtreecommitdiffstats
path: root/src/drivers/driver_wext.c
diff options
context:
space:
mode:
authorJouni Malinen <jouni.malinen@atheros.com>2008-08-27 06:52:16 (GMT)
committerJouni Malinen <j@w1.fi>2008-08-27 06:52:16 (GMT)
commitfd630bc183fb79d0a14b5f3a346544f3d277bd05 (patch)
treeff8560fd85aa8f00a5124f00ebef4ef973e01661 /src/drivers/driver_wext.c
parent00ad53ef6816a417fc7d3756c3652c5c0d605af9 (diff)
downloadhostap-fd630bc183fb79d0a14b5f3a346544f3d277bd05.zip
hostap-fd630bc183fb79d0a14b5f3a346544f3d277bd05.tar.gz
hostap-fd630bc183fb79d0a14b5f3a346544f3d277bd05.tar.bz2
Fixed WEXT scan result parser to not crash on invalid IEs (zero len buffer)
If IWEVGENIE or custom event wpa_ie/rsn_ie is received in scan with empty buffer, the previous version ended up calling realloc(NULL, 0) which seems to return a non-NULL value in some cases. When this return value is passed again into realloc with realloc(ptr, 0), the returned value could be NULL. If the ptr is then freed (os_free(data.ie) in SIOCGIWAP handling), glibc may crash due to invalid pointer being freed (or double-freed?). The non-NULL realloc(NULL, 0) return value from glibc looks a bit odd behavior, but anyway, better avoid this case completely and just skip the IE events that have an empty buffer. This issue should not show up with drivers that produce proper scan results since the IEs will always include the two-octet header. However, it seems to be possible to see this when using 64-bit kernel and 32-bit userspace with incorrect compat-ioctl processing.
Diffstat (limited to 'src/drivers/driver_wext.c')
-rw-r--r--src/drivers/driver_wext.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/src/drivers/driver_wext.c b/src/drivers/driver_wext.c
index 6aac427..a3c4733 100644
--- a/src/drivers/driver_wext.c
+++ b/src/drivers/driver_wext.c
@@ -1447,6 +1447,9 @@ static void wext_get_scan_iwevgenie(struct iw_event *iwe,
char *genie, *gpos, *gend;
u8 *tmp;
+ if (iwe->u.data.length == 0)
+ return;
+
gpos = genie = custom;
gend = genie + iwe->u.data.length;
if (gend > end) {
@@ -1479,7 +1482,7 @@ static void wext_get_scan_custom(struct iw_event *iwe,
int bytes;
spos = custom + 7;
bytes = custom + clen - spos;
- if (bytes & 1)
+ if (bytes & 1 || bytes == 0)
return;
bytes /= 2;
tmp = os_realloc(res->ie, res->ie_len + bytes);
@@ -1493,7 +1496,7 @@ static void wext_get_scan_custom(struct iw_event *iwe,
int bytes;
spos = custom + 7;
bytes = custom + clen - spos;
- if (bytes & 1)
+ if (bytes & 1 || bytes == 0)
return;
bytes /= 2;
tmp = os_realloc(res->ie, res->ie_len + bytes);