Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fix/supplicant_checks_v6.1' into 'release/v6.1'

Browse Source 
Fixed OOB read on short FT auth and RRM action frames(v6.1)

See merge request espressif/esp-idf!52708
This commit is contained in:
Jiang Jiang Jian
2026-09-16 09:55:27 +08:00
parent dc74222237 91e96a3447
commit 51b266a62b
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/wpa_supplicant/esp_supplicant/src/esp_common.c
+10 -1
View File
@@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2020-2025 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2020-2026 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
@@ -43,6 +43,9 @@ struct wpa_supplicant g_wpa_supp;
static void handle_rrm_frame(struct wpa_supplicant *wpa_s, u8 *sender, static void handle_rrm_frame(struct wpa_supplicant *wpa_s, u8 *sender,
u8 *payload, size_t len, int8_t rssi) u8 *payload, size_t len, int8_t rssi)
{ {
if (len < 1) {
return;
}
if (payload[0] == WLAN_RRM_NEIGHBOR_REPORT_RESPONSE) { if (payload[0] == WLAN_RRM_NEIGHBOR_REPORT_RESPONSE) {
/* neighbor report parsing */ /* neighbor report parsing */
wpas_rrm_process_neighbor_rep(wpa_s, payload + 1, len - 1); wpas_rrm_process_neighbor_rep(wpa_s, payload + 1, len - 1);
@@ -72,6 +75,9 @@ static int mgmt_rx_action(u8 *frame, size_t len, u8 *sender, int8_t rssi, u8 cha
return -1; return -1;
} }
if (len < 1) {
return -1;
}
category = *frame++; category = *frame++;
len--; len--;
#if defined(CONFIG_WNM) #if defined(CONFIG_WNM)
@@ -155,6 +161,9 @@ static int handle_auth_frame(u8 *frame, size_t len,
u8 *sender, int8_t rssi, u8 channel) u8 *sender, int8_t rssi, u8 channel)
{ {
if (gWpaSm.key_mgmt == WPA_KEY_MGMT_FT_PSK || gWpaSm.key_mgmt == WPA_KEY_MGMT_FT_SAE) { if (gWpaSm.key_mgmt == WPA_KEY_MGMT_FT_PSK || gWpaSm.key_mgmt == WPA_KEY_MGMT_FT_SAE) {
if (len < 6) {
return -1;
}
if (gWpaSm.ft_protocol) { if (gWpaSm.ft_protocol) {
if (wpa_ft_process_response(&gWpaSm, frame + 6, if (wpa_ft_process_response(&gWpaSm, frame + 6,
len - 6, 0, sender, NULL, 0) < 0) { len - 6, 0, sender, NULL, 0) < 0) {