aboutsummaryrefslogtreecommitdiffstats
path: root/hs20
diff options
context:
space:
mode:
authorSubhani Shaik <subhanis@qca.qualcomm.com>2015-02-18 00:06:35 (GMT)
committerJouni Malinen <j@w1.fi>2015-02-19 11:39:15 (GMT)
commit715d5c45f13a79c46544753b4046fc17e2c3062d (patch)
tree9dd2f569ce496315c370fa1d405ee24dc69b9786 /hs20
parent58d405fcdb235649f587c5d7dc3b481e7f857cbe (diff)
downloadhostap-715d5c45f13a79c46544753b4046fc17e2c3062d.zip
hostap-715d5c45f13a79c46544753b4046fc17e2c3062d.tar.gz
hostap-715d5c45f13a79c46544753b4046fc17e2c3062d.tar.bz2
hs20-osu-client: Ensure NULL checks are done before dereferencing
In some error cases, pointers were dereferenced before NULL check is done. Fix this by adding checks before the dereference. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Diffstat (limited to 'hs20')
-rw-r--r--hs20/client/oma_dm_client.c17
-rw-r--r--hs20/client/osu_client.c4
2 files changed, 21 insertions, 0 deletions
diff --git a/hs20/client/oma_dm_client.c b/hs20/client/oma_dm_client.c
index 82e9106..6eaeeb4 100644
--- a/hs20/client/oma_dm_client.c
+++ b/hs20/client/oma_dm_client.c
@@ -394,6 +394,10 @@ static int oma_dm_exec_browser(struct hs20_osu_client *ctx, xml_node_t *exec)
}
data = xml_node_get_text(ctx->xml, node);
+ if (data == NULL) {
+ wpa_printf(MSG_INFO, "Invalid data");
+ return DM_RESP_BAD_REQUEST;
+ }
wpa_printf(MSG_INFO, "Data: %s", data);
wpa_printf(MSG_INFO, "Launch browser to URI '%s'", data);
write_summary(ctx, "Launch browser to URI '%s'", data);
@@ -428,6 +432,10 @@ static int oma_dm_exec_get_cert(struct hs20_osu_client *ctx, xml_node_t *exec)
}
data = xml_node_get_text(ctx->xml, node);
+ if (data == NULL) {
+ wpa_printf(MSG_INFO, "Invalid data");
+ return DM_RESP_BAD_REQUEST;
+ }
wpa_printf(MSG_INFO, "Data: %s", data);
getcert = xml_node_from_buf(ctx->xml, data);
xml_node_get_text_free(ctx->xml, data);
@@ -576,6 +584,11 @@ static int oma_dm_run_add(struct hs20_osu_client *ctx, const char *locuri,
if (node) {
char *type;
type = xml_node_get_text(ctx->xml, node);
+ if (type == NULL) {
+ wpa_printf(MSG_ERROR, "Could not find type text");
+ os_free(uri);
+ return DM_RESP_BAD_REQUEST;
+ }
use_tnds = node &&
os_strstr(type, "application/vnd.syncml.dmtnds+xml");
}
@@ -648,6 +661,10 @@ static int oma_dm_add(struct hs20_osu_client *ctx, xml_node_t *add,
return DM_RESP_BAD_REQUEST;
}
locuri = xml_node_get_text(ctx->xml, node);
+ if (locuri == NULL) {
+ wpa_printf(MSG_ERROR, "No LocURI node text found");
+ return DM_RESP_BAD_REQUEST;
+ }
wpa_printf(MSG_INFO, "Target LocURI: %s", locuri);
if (os_strncasecmp(locuri, "./Wi-Fi/", 8) != 0) {
wpa_printf(MSG_INFO, "Unsupported Add Target LocURI");
diff --git a/hs20/client/osu_client.c b/hs20/client/osu_client.c
index 6603425..de7f351 100644
--- a/hs20/client/osu_client.c
+++ b/hs20/client/osu_client.c
@@ -687,6 +687,10 @@ int update_pps_file(struct hs20_osu_client *ctx, const char *pps_fname,
wpa_printf(MSG_INFO, "Updating PPS MO %s", pps_fname);
str = xml_node_to_str(ctx->xml, pps);
+ if (str == NULL) {
+ wpa_printf(MSG_ERROR, "No node found");
+ return -1;
+ }
wpa_printf(MSG_MSGDUMP, "[hs20] Updated PPS: '%s'", str);
snprintf(backup, sizeof(backup), "%s.bak", pps_fname);