aboutsummaryrefslogtreecommitdiffstats
path: root/wpa_supplicant/dbus/dbus_old_handlers.c
diff options
context:
space:
mode:
authorJouni Malinen <j@w1.fi>2014-12-27 20:50:17 (GMT)
committerJouni Malinen <j@w1.fi>2014-12-29 13:49:05 (GMT)
commit62856ad9899351598851b839fd3e5a4e3e7304b2 (patch)
tree7c105401f71ae81b140553894871e4c5c216bd02 /wpa_supplicant/dbus/dbus_old_handlers.c
parent84edd136b5f0c303be0eeb43374da5aaafcc173e (diff)
downloadhostap-62856ad9899351598851b839fd3e5a4e3e7304b2.zip
hostap-62856ad9899351598851b839fd3e5a4e3e7304b2.tar.gz
hostap-62856ad9899351598851b839fd3e5a4e3e7304b2.tar.bz2
D-Bus(old): Fix removeNetwork and selectNetwork error handling
wpas_dbus_decompose_object_path() may leave the network part NULL on unexpected path. This resulted in NULL pointer dereference when processing an invalid removeNetwork or selectNetwork call. Fix this by explicitly verifying that the network part was included in the object path. Signed-off-by: Jouni Malinen <j@w1.fi>
Diffstat (limited to 'wpa_supplicant/dbus/dbus_old_handlers.c')
-rw-r--r--wpa_supplicant/dbus/dbus_old_handlers.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/wpa_supplicant/dbus/dbus_old_handlers.c b/wpa_supplicant/dbus/dbus_old_handlers.c
index c37f770..588042b 100644
--- a/wpa_supplicant/dbus/dbus_old_handlers.c
+++ b/wpa_supplicant/dbus/dbus_old_handlers.c
@@ -846,7 +846,7 @@ DBusMessage * wpas_dbus_iface_remove_network(DBusMessage *message,
/* Extract the network ID */
iface = wpas_dbus_decompose_object_path(op, &net_id, NULL);
- if (iface == NULL) {
+ if (iface == NULL || net_id == NULL) {
reply = wpas_dbus_new_invalid_network_error(message);
goto out;
}
@@ -1102,7 +1102,8 @@ DBusMessage * wpas_dbus_iface_select_network(DBusMessage *message,
goto out;
}
/* Ensure the object path really points to this interface */
- if (os_strcmp(iface_obj_path, wpa_s->dbus_path) != 0) {
+ if (network == NULL ||
+ os_strcmp(iface_obj_path, wpa_s->dbus_path) != 0) {
reply = wpas_dbus_new_invalid_network_error(message);
goto out;
}