Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(wifi) : Fixed OOB read on short FT auth and RRM action frames

Browse Source
This commit is contained in:
tarun.kumar
2026-09-20 16:10:53 +08:00
committed by BOT
parent f3009ccbac
commit 8eaf37bb09
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/wpa_supplicant/esp_supplicant/src/esp_common.c
+10 -1
View File
@@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2020-2025 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2020-2026 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
@@ -42,6 +42,9 @@ struct wpa_supplicant g_wpa_supp;
static void handle_rrm_frame(struct wpa_supplicant *wpa_s, u8 *sender, static void handle_rrm_frame(struct wpa_supplicant *wpa_s, u8 *sender,
u8 *payload, size_t len, int8_t rssi) u8 *payload, size_t len, int8_t rssi)
{ {
if (len < 1) {
return;
}
if (payload[0] == WLAN_RRM_NEIGHBOR_REPORT_RESPONSE) { if (payload[0] == WLAN_RRM_NEIGHBOR_REPORT_RESPONSE) {
/* neighbor report parsing */ /* neighbor report parsing */
wpas_rrm_process_neighbor_rep(wpa_s, payload + 1, len - 1); wpas_rrm_process_neighbor_rep(wpa_s, payload + 1, len - 1);
@@ -71,6 +74,9 @@ static int mgmt_rx_action(u8 *frame, size_t len, u8 *sender, int8_t rssi, u8 cha
return -1; return -1;
} }
if (len < 1) {
return -1;
}
category = *frame++; category = *frame++;
len--; len--;
#if defined(CONFIG_WNM) #if defined(CONFIG_WNM)
@@ -154,6 +160,9 @@ static int handle_auth_frame(u8 *frame, size_t len,
u8 *sender, int8_t rssi, u8 channel) u8 *sender, int8_t rssi, u8 channel)
{ {
if (gWpaSm.key_mgmt == WPA_KEY_MGMT_FT_PSK) { if (gWpaSm.key_mgmt == WPA_KEY_MGMT_FT_PSK) {
if (len < 6) {
return -1;
}
if (gWpaSm.ft_protocol) { if (gWpaSm.ft_protocol) {
if (wpa_ft_process_response(&gWpaSm, frame + 6, if (wpa_ft_process_response(&gWpaSm, frame + 6,
len - 6, 0, sender, NULL, 0) < 0) { len - 6, 0, sender, NULL, 0) < 0) {