Android-x86
Fork
Donation

  • R/O
  • HTTP
  • SSH
  • HTTPS

external-wpa_supplicant_8: 提交

external/wpa_supplicant_8


Commit MetaInfo

修订版4cf0f2d0d869c35a9ec4432861d5efa8ead4279c (tree)
时间2015-07-10 06:02:51
作者Jouni Malinen <jouni@qca....>
CommiterThe Android Automerger

Log Message

P2P: Validate SSID element length before copying it

This fixes a possible memcpy overflow for P2P dev->oper_ssid in
p2p_add_device(). The length provided by the peer device (0..255 bytes)
was used without proper bounds checking and that could have resulted in
arbitrary data of up to 223 bytes being written beyond the end of the
dev->oper_ssid[] array (of which about 150 bytes would be beyond the
heap allocation) when processing a corrupted management frame for P2P
peer discovery purposes.

This could result in corrupted state in heap, unexpected program
behavior due to corrupted P2P peer device information, denial of service
due to process crash, exposure of memory contents during GO Negotiation,
and potentially arbitrary code execution.

Thanks to Google security team for reporting this issue and smart
hardware research group of Alibaba security team for discovering it.

Change-Id: I9f350f20cdd010f2c096514b245b4a901ad74e46
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

更改概述

差异

--- a/src/p2p/p2p.c
+++ b/src/p2p/p2p.c
@@ -736,6 +736,7 @@ int p2p_add_device(struct p2p_data *p2p, const u8 *addr, int freq,
736736 if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0)
737737 os_memcpy(dev->interface_addr, addr, ETH_ALEN);
738738 if (msg.ssid &&
739+ msg.ssid[1] <= sizeof(dev->oper_ssid) &&
739740 (msg.ssid[1] != P2P_WILDCARD_SSID_LEN ||
740741 os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN)
741742 != 0)) {
Show on old repository browser