From 650013068e98fcda16079b24f17da85ed8a7ebbd Mon Sep 17 00:00:00 2001 From: "tarun.kumar" Date: Thu, 23 Jul 2026 18:16:38 +0530 Subject: [PATCH] fix(wifi) : Add length/NULL checks and some minor changes - Check os_malloc failure in wpas_mbo_update_non_pref_chan - Guard WAPI EID read with wpa_ie_len >= 1 in wpa_parse_wpa_ie - Require full 5-byte RRM Enabled Capabilities IE before copy - NULL-check FT mobility domain before memcmp in wpa_set_bss - Use wpabuf_clear_free for WPS decrypted M4/M6/M8 data - Drop redundant wpabuf_free before clear_free in eap_peap --- components/wpa_supplicant/esp_supplicant/src/esp_common.c | 2 +- components/wpa_supplicant/src/common/mbo.c | 4 ++++ components/wpa_supplicant/src/eap_peer/eap_peap.c | 1 - components/wpa_supplicant/src/rsn_supp/wpa.c | 3 ++- components/wpa_supplicant/src/wps/wps_enrollee.c | 8 ++++---- 5 files changed, 11 insertions(+), 7 deletions(-) diff --git a/components/wpa_supplicant/esp_supplicant/src/esp_common.c b/components/wpa_supplicant/esp_supplicant/src/esp_common.c index ec30a9765aa..811dcf905b8 100644 --- a/components/wpa_supplicant/esp_supplicant/src/esp_common.c +++ b/components/wpa_supplicant/esp_supplicant/src/esp_common.c @@ -356,7 +356,7 @@ void supplicant_sta_conn_handler(uint8_t *bssid) ie += sizeof(struct wpa_bss); #ifdef CONFIG_RRM ieee802_11_parse_elems(ie, bss->ie_len, &elems, 0); - if (elems.rrm_enabled_len > 0 && elems.rrm_enabled != NULL) { + if (elems.rrm_enabled && elems.rrm_enabled_len >= 5) { os_memcpy(wpa_s->rrm_ie, elems.rrm_enabled, 5); wpa_s->rrm.rrm_used = true; } diff --git a/components/wpa_supplicant/src/common/mbo.c b/components/wpa_supplicant/src/common/mbo.c index 8da5a2f7d81..5e01b0ccf88 100644 --- a/components/wpa_supplicant/src/common/mbo.c +++ b/components/wpa_supplicant/src/common/mbo.c @@ -464,6 +464,10 @@ int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s, chans = os_malloc(sizeof(struct wpa_mbo_non_pref_channel) * non_pref_chan->non_pref_chan_num); + if (!chans) { + wpa_printf(MSG_ERROR, "Failed to allocate memory for non_pref_chan"); + return -1; + } os_memcpy(chans, non_pref_chan->chan, sizeof(struct wpa_mbo_non_pref_channel) * non_pref_chan->non_pref_chan_num); update: diff --git a/components/wpa_supplicant/src/eap_peer/eap_peap.c b/components/wpa_supplicant/src/eap_peer/eap_peap.c index 312536a8806..afbb23e95b1 100644 --- a/components/wpa_supplicant/src/eap_peer/eap_peap.c +++ b/components/wpa_supplicant/src/eap_peer/eap_peap.c @@ -1279,7 +1279,6 @@ static struct wpabuf * eap_peap_process(struct eap_sm *sm, void *priv, /* * Application data included in the handshake message. */ - wpabuf_free(data->pending_phase2_req); wpabuf_clear_free(data->pending_phase2_req); data->pending_phase2_req = resp; resp = NULL; diff --git a/components/wpa_supplicant/src/rsn_supp/wpa.c b/components/wpa_supplicant/src/rsn_supp/wpa.c index 33712aebe58..1b9cffa5739 100644 --- a/components/wpa_supplicant/src/rsn_supp/wpa.c +++ b/components/wpa_supplicant/src/rsn_supp/wpa.c @@ -2755,7 +2755,8 @@ int wpa_set_bss(uint8_t *macddr, uint8_t *bssid, uint8_t pairwise_cipher, uint8_ ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN); if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN) md = ie + 2; - if (os_memcmp(md, sm->mobility_domain, MOBILITY_DOMAIN_ID_LEN) != 0) { + if (md == NULL || + os_memcmp(md, sm->mobility_domain, MOBILITY_DOMAIN_ID_LEN) != 0) { /* Reset Auth IE here */ esp_wifi_unset_appie_internal(WIFI_APPIE_RAM_STA_AUTH); esp_wifi_unset_appie_internal(WIFI_APPIE_ASSOC_REQ); diff --git a/components/wpa_supplicant/src/wps/wps_enrollee.c b/components/wpa_supplicant/src/wps/wps_enrollee.c index 2f8e1aacfd4..692690a9bb5 100644 --- a/components/wpa_supplicant/src/wps/wps_enrollee.c +++ b/components/wpa_supplicant/src/wps/wps_enrollee.c @@ -1182,7 +1182,7 @@ static enum wps_process_res wps_process_m4(struct wps_data *wps, if (wps_parse_msg(decrypted, eattr) < 0 || wps_process_key_wrap_auth(wps, decrypted, eattr->key_wrap_auth) || wps_process_r_snonce1(wps, eattr->r_snonce1)) { - wpabuf_free(decrypted); + wpabuf_clear_free(decrypted); wps->state = SEND_WSC_NACK; res = WPS_CONTINUE; goto _out; @@ -1252,7 +1252,7 @@ static enum wps_process_res wps_process_m6(struct wps_data *wps, if (wps_parse_msg(decrypted, eattr) < 0 || wps_process_key_wrap_auth(wps, decrypted, eattr->key_wrap_auth) || wps_process_r_snonce2(wps, eattr->r_snonce2)) { - wpabuf_free(decrypted); + wpabuf_clear_free(decrypted); wps->state = SEND_WSC_NACK; res = WPS_CONTINUE; goto _out; @@ -1344,12 +1344,12 @@ static enum wps_process_res wps_process_m8(struct wps_data *wps, eattr->num_cred, attr->version2 != NULL) || wps_process_ap_settings_e(wps, eattr, decrypted, attr->version2 != NULL)) { - wpabuf_free(decrypted); + wpabuf_clear_free(decrypted); wps->state = SEND_WSC_NACK; res = WPS_CONTINUE; goto _out; } - wpabuf_free(decrypted); + wpabuf_clear_free(decrypted); wps->state = WPS_MSG_DONE; res = WPS_CONTINUE;