path: root/wpa_supplicant
diff options
authorAmit Purwar <amit.purwar@samsung.com>2016-12-09 13:25:59 (GMT)
committerJouni Malinen <j@w1.fi>2016-12-11 10:45:08 (GMT)
commit944d48588915834cdcf5e255b4612f282128da0a (patch)
tree739f4bac708014aa128ef89f09fb7f8ae47040f5 /wpa_supplicant
parentc7c4600260379d5209a9024aa98a192f92f76f8a (diff)
P2P: Fix a theoretical out of bounds read in wpas_p2p_setup_freqs()
Commit 370017d968e071522357ea88c0c6aaed02853222 ('P2P: Use preferred frequency list from the local driver') introduced this loop to go through preferred channel list from the driver. The loop does bounds checking of the index only after having read a value from the array. That could in theory read one entry beyond the end of the stack buffer. Fix this by moving the index variable check to be done before using it to fetch a value from the array. This code is used only if wpa_supplicant is build with CONFIG_DRIVER_NL80211_QCA=y and if the driver supports the vendor extension (get_pref_freq_list() driver op). In addition, the driver would need to return more than P2P_MAX_PREF_CHANNELS (= 100) preferred channels for this to actually be able to read beyond the buffer. No driver is known to return that many preferred channels, so this does not seem to be reachable in practice. Signed-off-by: Amit Purwar <amit.purwar@samsung.com> Signed-off-by: Mayank Haarit <mayank.h@samsung.com>
Diffstat (limited to 'wpa_supplicant')
1 files changed, 3 insertions, 3 deletions
diff --git a/wpa_supplicant/p2p_supplicant.c b/wpa_supplicant/p2p_supplicant.c
index 2da92bf..75ee852 100644
--- a/wpa_supplicant/p2p_supplicant.c
+++ b/wpa_supplicant/p2p_supplicant.c
@@ -5239,11 +5239,11 @@ static int wpas_p2p_setup_freqs(struct wpa_supplicant *wpa_s, int freq,
if (!res && max_pref_freq > 0) {
*num_pref_freq = max_pref_freq;
i = 0;
- while ((!p2p_supported_freq(wpa_s->global->p2p,
+ while (i < *num_pref_freq &&
+ (!p2p_supported_freq(wpa_s->global->p2p,
pref_freq_list[i]) ||
- pref_freq_list[i])) &&
- i < *num_pref_freq) {
+ pref_freq_list[i]))) {
"P2P: preferred_freq_list[%d]=%d is disallowed",
i, pref_freq_list[i]);