aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJouni Malinen <jouni@qca.qualcomm.com>2015-04-07 11:32:11 +0300
committerWolfgang Wiedmeyer <wolfgit@wiedmeyer.de>2015-10-17 23:58:46 +0200
commit6757dd4d28da76ef28d48e840a4c9ad13b87230f (patch)
tree87c1c088cedb3dbb8fe44e48f90b87471fe4165a
parent161f26dcfb2f9ff69e3ba5457d8074157f1ced33 (diff)
downloadexternal_wpa_supplicant_8_ti-6757dd4d28da76ef28d48e840a4c9ad13b87230f.zip
external_wpa_supplicant_8_ti-6757dd4d28da76ef28d48e840a4c9ad13b87230f.tar.gz
external_wpa_supplicant_8_ti-6757dd4d28da76ef28d48e840a4c9ad13b87230f.tar.bz2
P2P: Validate SSID element length before copying it
This fixes a possible memcpy overflow for P2P dev->oper_ssid in p2p_add_device(). The length provided by the peer device (0..255 bytes) was used without proper bounds checking and that could have resulted in arbitrary data of up to 223 bytes being written beyond the end of the dev->oper_ssid[] array (of which about 150 bytes would be beyond the heap allocation) when processing a corrupted management frame for P2P peer discovery purposes. This could result in corrupted state in heap, unexpected program behavior due to corrupted P2P peer device information, denial of service due to process crash, exposure of memory contents during GO Negotiation, and potentially arbitrary code execution. Thanks to Google security team for reporting this issue and smart hardware research group of Alibaba security team for discovering it. Change-Id: I9f350f20cdd010f2c096514b245b4a901ad74e46 Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
-rw-r--r--src/p2p/p2p.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c
index df6697a..1baf8b4 100644
--- a/src/p2p/p2p.c
+++ b/src/p2p/p2p.c
@@ -690,6 +690,7 @@ int p2p_add_device(struct p2p_data *p2p, const u8 *addr, int freq,
if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0)
os_memcpy(dev->interface_addr, addr, ETH_ALEN);
if (msg.ssid &&
+ msg.ssid[1] <= sizeof(dev->oper_ssid) &&
(msg.ssid[1] != P2P_WILDCARD_SSID_LEN ||
os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN)
!= 0)) {