diff options
authorJouni Malinen <j@w1.fi>2019-11-23 15:39:55 (GMT)
committerJouni Malinen <j@w1.fi>2019-11-23 15:39:55 (GMT)
commit5b50265e133d2ce111211e69d584ba71bf0551e4 (patch)
parente8ccbef25123e66ab600fef0e1f9da6ded96cddb (diff)
WMM: Do not modify input TSPEC buffer during processing
The WMM TSPEC processor used the input buffer for processing the request and building the response. This was fine for the FT case, but for the WMM Action frame case, the input buffer is marked const, so it should not really be modified. This modification could not really cause any noticeable harm, but it can result in error reports from fuzzing and potentially even from some static analyzers. Fix this by marking the input arguments const more consistently (the parsed IE was able to drop the const) and copy the const input data to a temporary buffer for processing and modification instead of allowing the input data to be modified. Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19050 Signed-off-by: Jouni Malinen <j@w1.fi>
1 files changed, 5 insertions, 3 deletions
diff --git a/src/ap/wmm.c b/src/ap/wmm.c
index dc73493..9f52dee 100644
--- a/src/ap/wmm.c
+++ b/src/ap/wmm.c
@@ -291,10 +291,11 @@ int wmm_process_tspec(struct wmm_tspec_element *tspec)
static void wmm_addts_req(struct hostapd_data *hapd,
const struct ieee80211_mgmt *mgmt,
- struct wmm_tspec_element *tspec, size_t len)
+ const struct wmm_tspec_element *tspec, size_t len)
const u8 *end = ((const u8 *) mgmt) + len;
int res;
+ struct wmm_tspec_element tspec_resp;
if ((const u8 *) (tspec + 1) > end) {
wpa_printf(MSG_DEBUG, "WMM: TSPEC overflow in ADDTS Request");
@@ -306,10 +307,11 @@ static void wmm_addts_req(struct hostapd_data *hapd,
- res = wmm_process_tspec(tspec);
+ os_memcpy(&tspec_resp, tspec, sizeof(struct wmm_tspec_element));
+ res = wmm_process_tspec(&tspec_resp);
wpa_printf(MSG_DEBUG, "WMM: ADDTS processing result: %d", res);
- wmm_send_action(hapd, mgmt->sa, tspec, WMM_ACTION_CODE_ADDTS_RESP,
+ wmm_send_action(hapd, mgmt->sa, &tspec_resp, WMM_ACTION_CODE_ADDTS_RESP,
mgmt->u.action.u.wmm_action.dialog_token, res);