Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(wifi) : Add length/NULL checks and some minor changes

Browse Source 
- Check os_malloc failure in wpas_mbo_update_non_pref_chan
  - Guard WAPI EID read with wpa_ie_len >= 1 in wpa_parse_wpa_ie
  - Require full 5-byte RRM Enabled Capabilities IE before copy
  - NULL-check FT mobility domain before memcmp in wpa_set_bss
  - Use wpabuf_clear_free for WPS decrypted M4/M6/M8 data
  - Drop redundant wpabuf_free before clear_free in eap_peap
This commit is contained in:
tarun.kumar
2026-09-18 12:02:08 +05:30
parent 0974aac0a7
commit 650013068e
5 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/wpa_supplicant/esp_supplicant/src/esp_common.c
+1 -1
View File
@@ -356,7 +356,7 @@ void supplicant_sta_conn_handler(uint8_t *bssid)
ie += sizeof(struct wpa_bss); ie += sizeof(struct wpa_bss);
#ifdef CONFIG_RRM #ifdef CONFIG_RRM
ieee802_11_parse_elems(ie, bss->ie_len, &elems, 0); ieee802_11_parse_elems(ie, bss->ie_len, &elems, 0);
if (elems.rrm_enabled_len > 0 && elems.rrm_enabled != NULL) { if (elems.rrm_enabled && elems.rrm_enabled_len >= 5) {
os_memcpy(wpa_s->rrm_ie, elems.rrm_enabled, 5); os_memcpy(wpa_s->rrm_ie, elems.rrm_enabled, 5);
wpa_s->rrm.rrm_used = true; wpa_s->rrm.rrm_used = true;
} }
components/wpa_supplicant/src/common/mbo.c
+4
View File
@@ -464,6 +464,10 @@ int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s,
chans = os_malloc(sizeof(struct wpa_mbo_non_pref_channel) * non_pref_chan->non_pref_chan_num); chans = os_malloc(sizeof(struct wpa_mbo_non_pref_channel) * non_pref_chan->non_pref_chan_num);
if (!chans) {
wpa_printf(MSG_ERROR, "Failed to allocate memory for non_pref_chan");
return -1;
}
os_memcpy(chans, non_pref_chan->chan, sizeof(struct wpa_mbo_non_pref_channel) * non_pref_chan->non_pref_chan_num); os_memcpy(chans, non_pref_chan->chan, sizeof(struct wpa_mbo_non_pref_channel) * non_pref_chan->non_pref_chan_num);
update: update:
components/wpa_supplicant/src/eap_peer/eap_peap.c
-1
View File
@@ -1279,7 +1279,6 @@ static struct wpabuf * eap_peap_process(struct eap_sm *sm, void *priv,
/* /*
* Application data included in the handshake message. * Application data included in the handshake message.
*/ */
wpabuf_free(data->pending_phase2_req);
wpabuf_clear_free(data->pending_phase2_req); wpabuf_clear_free(data->pending_phase2_req);
data->pending_phase2_req = resp; data->pending_phase2_req = resp;
resp = NULL; resp = NULL;
components/wpa_supplicant/src/rsn_supp/wpa.c
+2 -1
View File
@@ -2755,7 +2755,8 @@ int wpa_set_bss(uint8_t *macddr, uint8_t *bssid, uint8_t pairwise_cipher, uint8_
ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN); ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN) if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
md = ie + 2; md = ie + 2;
if (os_memcmp(md, sm->mobility_domain, MOBILITY_DOMAIN_ID_LEN) != 0) { if (md == NULL ||
os_memcmp(md, sm->mobility_domain, MOBILITY_DOMAIN_ID_LEN) != 0) {
/* Reset Auth IE here */ /* Reset Auth IE here */
esp_wifi_unset_appie_internal(WIFI_APPIE_RAM_STA_AUTH); esp_wifi_unset_appie_internal(WIFI_APPIE_RAM_STA_AUTH);
esp_wifi_unset_appie_internal(WIFI_APPIE_ASSOC_REQ); esp_wifi_unset_appie_internal(WIFI_APPIE_ASSOC_REQ);
components/wpa_supplicant/src/wps/wps_enrollee.c
+4 -4
View File
@@ -1182,7 +1182,7 @@ static enum wps_process_res wps_process_m4(struct wps_data *wps,
if (wps_parse_msg(decrypted, eattr) < 0 || if (wps_parse_msg(decrypted, eattr) < 0 ||
wps_process_key_wrap_auth(wps, decrypted, eattr->key_wrap_auth) || wps_process_key_wrap_auth(wps, decrypted, eattr->key_wrap_auth) ||
wps_process_r_snonce1(wps, eattr->r_snonce1)) { wps_process_r_snonce1(wps, eattr->r_snonce1)) {
wpabuf_free(decrypted); wpabuf_clear_free(decrypted);
wps->state = SEND_WSC_NACK; wps->state = SEND_WSC_NACK;
res = WPS_CONTINUE; res = WPS_CONTINUE;
goto _out; goto _out;
@@ -1252,7 +1252,7 @@ static enum wps_process_res wps_process_m6(struct wps_data *wps,
if (wps_parse_msg(decrypted, eattr) < 0 || if (wps_parse_msg(decrypted, eattr) < 0 ||
wps_process_key_wrap_auth(wps, decrypted, eattr->key_wrap_auth) || wps_process_key_wrap_auth(wps, decrypted, eattr->key_wrap_auth) ||
wps_process_r_snonce2(wps, eattr->r_snonce2)) { wps_process_r_snonce2(wps, eattr->r_snonce2)) {
wpabuf_free(decrypted); wpabuf_clear_free(decrypted);
wps->state = SEND_WSC_NACK; wps->state = SEND_WSC_NACK;
res = WPS_CONTINUE; res = WPS_CONTINUE;
goto _out; goto _out;
@@ -1344,12 +1344,12 @@ static enum wps_process_res wps_process_m8(struct wps_data *wps,
eattr->num_cred, attr->version2 != NULL) || eattr->num_cred, attr->version2 != NULL) ||
wps_process_ap_settings_e(wps, eattr, decrypted, wps_process_ap_settings_e(wps, eattr, decrypted,
attr->version2 != NULL)) { attr->version2 != NULL)) {
wpabuf_free(decrypted); wpabuf_clear_free(decrypted);
wps->state = SEND_WSC_NACK; wps->state = SEND_WSC_NACK;
res = WPS_CONTINUE; res = WPS_CONTINUE;
goto _out; goto _out;
} }
wpabuf_free(decrypted); wpabuf_clear_free(decrypted);
wps->state = WPS_MSG_DONE; wps->state = WPS_MSG_DONE;
res = WPS_CONTINUE; res = WPS_CONTINUE;