diff options
| author | Android Build Merger (Role) <noreply-android-build-merger@google.com> | 2019-03-07 03:11:59 +0000 |
|---|---|---|
| committer | Android Build Merger (Role) <noreply-android-build-merger@google.com> | 2019-03-07 03:11:59 +0000 |
| commit | d0d047b774853108d740e9eafacfef7d24b891de (patch) | |
| tree | a545450c7ecde27e857099e0257b85c17d891e2e | |
| parent | 1e6bb5fda6b5f977e604dc59c620a9b894a7a992 (diff) | |
| parent | 24b4de62be70920332bc7c0e1ba5635715863998 (diff) | |
| download | wpa_supplicant_8-d0d047b774853108d740e9eafacfef7d24b891de.tar.gz | |
[automerger] [wpa_supplicant] Fix security vulnerability wpa_supplicant/wnm_sta.c:376 am: 5e6e3f710f am: a80eaabb6b am: e2411dbf1e am: 24b4de62be
Change-Id: If51dd0621110119e2ed9fd61840fb63e5717b12d
| -rw-r--r-- | wpa_supplicant/wnm_sta.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c index 7dc1909d..63a87aff 100644 --- a/wpa_supplicant/wnm_sta.c +++ b/wpa_supplicant/wnm_sta.c @@ -372,6 +372,10 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep, rep->preference_present = 1; break; case WNM_NEIGHBOR_BSS_TERMINATION_DURATION: + if (elen < 10) { + wpa_printf(MSG_DEBUG, "WNM: Too short bss_term_tsf"); + break; + } rep->bss_term_tsf = WPA_GET_LE64(pos); rep->bss_term_dur = WPA_GET_LE16(pos + 8); rep->bss_term_present = 1; |