Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fix/supplicant_checks_v6.1' into 'release/v6.1'

Browse Source 
Fixed OOB read on short FT auth and RRM action frames(v6.1)

See merge request espressif/esp-idf!52708
This commit is contained in:
Jiang Jiang Jian
2026-09-16 09:55:27 +08:00
parent dc74222237 91e96a3447
commit 51b266a62b
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
components/wpa_supplicant/esp_supplicant/src/esp_common.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2020-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2020-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -43,6 +43,9 @@ struct wpa_supplicant g_wpa_supp;
static void handle_rrm_frame(struct wpa_supplicant *wpa_s, u8 *sender,
u8 *payload, size_t len, int8_t rssi)
{
if (len < 1) {
return;
}
if (payload[0] == WLAN_RRM_NEIGHBOR_REPORT_RESPONSE) {
/* neighbor report parsing */
wpas_rrm_process_neighbor_rep(wpa_s, payload + 1, len - 1);
@@ -72,6 +75,9 @@ static int mgmt_rx_action(u8 *frame, size_t len, u8 *sender, int8_t rssi, u8 cha
return -1;
}
if (len < 1) {
return -1;
}
category = *frame++;
len--;
#if defined(CONFIG_WNM)
@@ -155,6 +161,9 @@ static int handle_auth_frame(u8 *frame, size_t len,
u8 *sender, int8_t rssi, u8 channel)
{
if (gWpaSm.key_mgmt == WPA_KEY_MGMT_FT_PSK || gWpaSm.key_mgmt == WPA_KEY_MGMT_FT_SAE) {
if (len < 6) {
return -1;
}
if (gWpaSm.ft_protocol) {
if (wpa_ft_process_response(&gWpaSm, frame + 6,
len - 6, 0, sender, NULL, 0) < 0) {