Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(wifi) : Add length/NULL checks and some minor changes

Browse Source 
- Check os_malloc failure in wpas_mbo_update_non_pref_chan
  - Guard WAPI EID read with wpa_ie_len >= 1 in wpa_parse_wpa_ie
  - Require full 5-byte RRM Enabled Capabilities IE before copy
  - NULL-check FT mobility domain before memcmp in wpa_set_bss
  - Use wpabuf_clear_free for WPS decrypted M4/M6/M8 data
  - Drop redundant wpabuf_free before clear_free in eap_peap
This commit is contained in:
tarun.kumar
2026-07-23 18:16:38 +05:30
committed by BOT
parent 764a0c442e
commit 4bbab381f3
5 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
components/wpa_supplicant/esp_supplicant/src/esp_common.c
View File

@@ -347,7 +347,7 @@ void supplicant_sta_conn_handler(uint8_t *bssid)
ie += sizeof(struct wpa_bss);
#ifdef CONFIG_RRM
ieee802_11_parse_elems(ie, bss->ie_len, &elems, 0);
if (elems.rrm_enabled_len > 0 && elems.rrm_enabled != NULL) {
if (elems.rrm_enabled && elems.rrm_enabled_len >= 5) {
os_memcpy(wpa_s->rrm_ie, elems.rrm_enabled, 5);
wpa_s->rrm.rrm_used = true;
}

4
components/wpa_supplicant/src/common/mbo.c
View File

@@ -464,6 +464,10 @@ int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s,
chans = os_malloc(sizeof(struct wpa_mbo_non_pref_channel) * non_pref_chan->non_pref_chan_num);
if (!chans) {
wpa_printf(MSG_ERROR, "Failed to allocate memory for non_pref_chan");
return -1;
}
os_memcpy(chans, non_pref_chan->chan, sizeof(struct wpa_mbo_non_pref_channel) * non_pref_chan->non_pref_chan_num);
update:

1
components/wpa_supplicant/src/eap_peer/eap_peap.c
View File

@@ -1279,7 +1279,6 @@ static struct wpabuf * eap_peap_process(struct eap_sm *sm, void *priv,
/*
* Application data included in the handshake message.
*/
wpabuf_free(data->pending_phase2_req);
wpabuf_clear_free(data->pending_phase2_req);
data->pending_phase2_req = resp;
resp = NULL;

3
components/wpa_supplicant/src/rsn_supp/wpa.c
View File

@@ -2755,7 +2755,8 @@ int wpa_set_bss(uint8_t *macddr, uint8_t *bssid, uint8_t pairwise_cipher, uint8_
ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
md = ie + 2;
if (os_memcmp(md, sm->mobility_domain, MOBILITY_DOMAIN_ID_LEN) != 0) {
if (md == NULL ||
os_memcmp(md, sm->mobility_domain, MOBILITY_DOMAIN_ID_LEN) != 0) {
/* Reset Auth IE here */
esp_wifi_unset_appie_internal(WIFI_APPIE_RAM_STA_AUTH);
esp_wifi_unset_appie_internal(WIFI_APPIE_ASSOC_REQ);

8
components/wpa_supplicant/src/wps/wps_enrollee.c
View File

@@ -1182,7 +1182,7 @@ static enum wps_process_res wps_process_m4(struct wps_data *wps,
if (wps_parse_msg(decrypted, eattr) < 0 ||
wps_process_key_wrap_auth(wps, decrypted, eattr->key_wrap_auth) ||
wps_process_r_snonce1(wps, eattr->r_snonce1)) {
wpabuf_free(decrypted);
wpabuf_clear_free(decrypted);
wps->state = SEND_WSC_NACK;
res = WPS_CONTINUE;
goto _out;
@@ -1252,7 +1252,7 @@ static enum wps_process_res wps_process_m6(struct wps_data *wps,
if (wps_parse_msg(decrypted, eattr) < 0 ||
wps_process_key_wrap_auth(wps, decrypted, eattr->key_wrap_auth) ||
wps_process_r_snonce2(wps, eattr->r_snonce2)) {
wpabuf_free(decrypted);
wpabuf_clear_free(decrypted);
wps->state = SEND_WSC_NACK;
res = WPS_CONTINUE;
goto _out;
@@ -1344,12 +1344,12 @@ static enum wps_process_res wps_process_m8(struct wps_data *wps,
eattr->num_cred, attr->version2 != NULL) ||
wps_process_ap_settings_e(wps, eattr, decrypted,
attr->version2 != NULL)) {
wpabuf_free(decrypted);
wpabuf_clear_free(decrypted);
wps->state = SEND_WSC_NACK;
res = WPS_CONTINUE;
goto _out;
}
wpabuf_free(decrypted);
wpabuf_clear_free(decrypted);
wps->state = WPS_MSG_DONE;
res = WPS_CONTINUE;