aboutsummaryrefslogtreecommitdiffstats
path: root/wpa_supplicant/scan.c
diff options
context:
space:
mode:
authorJouni Malinen <j@w1.fi>2015-10-18 08:52:32 (GMT)
committerJouni Malinen <j@w1.fi>2015-10-25 13:34:59 (GMT)
commit904e977bc79cc82c073cba8f36fae8b20bff2baf (patch)
tree32e5040e5cdbe783c9f63511f255440569811135 /wpa_supplicant/scan.c
parentbdce45b83e3a6c393d8e576f6b432c0ebe83f605 (diff)
downloadhostap-904e977bc79cc82c073cba8f36fae8b20bff2baf.zip
hostap-904e977bc79cc82c073cba8f36fae8b20bff2baf.tar.gz
hostap-904e977bc79cc82c073cba8f36fae8b20bff2baf.tar.bz2
Avoid undefined behavior in pointer arithmetic in scan result IE parsing
Reorder terms in a way that no invalid pointers are generated with pos+len operations. end-pos is always defined (with a valid pos pointer) while pos+len could end up pointing beyond the end pointer which would be undefined behavior. Signed-off-by: Jouni Malinen <j@w1.fi>
Diffstat (limited to 'wpa_supplicant/scan.c')
-rw-r--r--wpa_supplicant/scan.c16
1 files changed, 8 insertions, 8 deletions
diff --git a/wpa_supplicant/scan.c b/wpa_supplicant/scan.c
index d7049a1..2b41ca8 100644
--- a/wpa_supplicant/scan.c
+++ b/wpa_supplicant/scan.c
@@ -1521,8 +1521,8 @@ const u8 * wpa_scan_get_ie(const struct wpa_scan_res *res, u8 ie)
pos = (const u8 *) (res + 1);
end = pos + res->ie_len;
- while (pos + 1 < end) {
- if (pos + 2 + pos[1] > end)
+ while (end - pos > 1) {
+ if (2 + pos[1] > end - pos)
break;
if (pos[0] == ie)
return pos;
@@ -1550,8 +1550,8 @@ const u8 * wpa_scan_get_vendor_ie(const struct wpa_scan_res *res,
pos = (const u8 *) (res + 1);
end = pos + res->ie_len;
- while (pos + 1 < end) {
- if (pos + 2 + pos[1] > end)
+ while (end - pos > 1) {
+ if (2 + pos[1] > end - pos)
break;
if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
vendor_type == WPA_GET_BE32(&pos[2]))
@@ -1587,8 +1587,8 @@ const u8 * wpa_scan_get_vendor_ie_beacon(const struct wpa_scan_res *res,
pos += res->ie_len;
end = pos + res->beacon_ie_len;
- while (pos + 1 < end) {
- if (pos + 2 + pos[1] > end)
+ while (end - pos > 1) {
+ if (2 + pos[1] > end - pos)
break;
if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
vendor_type == WPA_GET_BE32(&pos[2]))
@@ -1623,8 +1623,8 @@ struct wpabuf * wpa_scan_get_vendor_ie_multi(const struct wpa_scan_res *res,
pos = (const u8 *) (res + 1);
end = pos + res->ie_len;
- while (pos + 1 < end) {
- if (pos + 2 + pos[1] > end)
+ while (end - pos > 1) {
+ if (2 + pos[1] > end - pos)
break;
if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
vendor_type == WPA_GET_BE32(&pos[2]))