diff options
| author | Hai Shalom <haishalom@google.com> | 2019-03-07 13:55:48 -0800 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2019-03-07 13:55:48 -0800 |
| commit | 8a6c2503ce9ff19c4d92d40be4a5a65989166ca2 (patch) | |
| tree | d66fa1e18f4737b6013e6ac0a2ea494988ec3ce9 | |
| parent | 2bbb11cdbe2749db2f689c7e2a52ebb78a34b30c (diff) | |
| parent | 695afc101c44dedbfb1b7bd60d0db0ea21bd4cdd (diff) | |
| download | wpa_supplicant_8-8a6c2503ce9ff19c4d92d40be4a5a65989166ca2.tar.gz | |
[automerger] [wpa_supplicant] Fix security vulnerability wpa_supplicant/wnm_sta.c:376 am: 5e6e3f710f am: a80eaabb6b am: e2411dbf1e am: 24b4de62be am: d0d047b774 am: 14e95b5516 am: 7157e49952
am: 695afc101c
Change-Id: Iab3235586938d6d0a90535486f6772aadb98e7ab
| -rw-r--r-- | wpa_supplicant/wnm_sta.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c index 28346ea9..3e27f0c2 100644 --- a/wpa_supplicant/wnm_sta.c +++ b/wpa_supplicant/wnm_sta.c @@ -373,6 +373,10 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep, rep->preference_present = 1; break; case WNM_NEIGHBOR_BSS_TERMINATION_DURATION: + if (elen < 10) { + wpa_printf(MSG_DEBUG, "WNM: Too short bss_term_tsf"); + break; + } rep->bss_term_tsf = WPA_GET_LE64(pos); rep->bss_term_dur = WPA_GET_LE16(pos + 8); rep->bss_term_present = 1; |