aboutsummaryrefslogtreecommitdiffstats
path: root/wpa_supplicant
diff options
context:
space:
mode:
authorAdiel Aloni <adiel.aloni@intel.com>2017-08-21 16:36:25 (GMT)
committerJouni Malinen <j@w1.fi>2017-09-10 19:16:06 (GMT)
commit2c66c7d115368f0875d89d7fbd25e9209ea3d915 (patch)
tree2eab7462a7bf533579abddeed86547cea9535ce5 /wpa_supplicant
parentfdbfb63e458c89a81b7dc63dc85410cccfc449e4 (diff)
downloadhostap-2c66c7d115368f0875d89d7fbd25e9209ea3d915.zip
hostap-2c66c7d115368f0875d89d7fbd25e9209ea3d915.tar.gz
hostap-2c66c7d115368f0875d89d7fbd25e9209ea3d915.tar.bz2
wpa_supplicant: Check length when building ext_capability in assoc_cb
When building wpa_ie in wpas_start_assoc_cb() with ext_capab, make sure that assignment does not exceed max_wpa_ie_len. Signed-off-by: Adiel Aloni <adiel.aloni@intel.com>
Diffstat (limited to 'wpa_supplicant')
-rw-r--r--wpa_supplicant/wpa_supplicant.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index 8814267..00ef3a4 100644
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -2572,7 +2572,8 @@ static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
int ext_capab_len;
ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
sizeof(ext_capab));
- if (ext_capab_len > 0) {
+ if (ext_capab_len > 0 &&
+ wpa_ie_len + ext_capab_len <= max_wpa_ie_len) {
u8 *pos = wpa_ie;
if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
pos += 2 + pos[1];