diff options
| author | Android Build Merger (Role) <noreply-android-build-merger@google.com> | 2018-11-02 17:20:58 +0000 |
|---|---|---|
| committer | Android Build Merger (Role) <noreply-android-build-merger@google.com> | 2018-11-02 17:20:58 +0000 |
| commit | fa9a73bdd45dd9b88bacc4e0c53f63da7ecfe010 (patch) | |
| tree | 76c86e5f600fb49046dc102bab77ff2dd2e99de2 | |
| parent | 32821e9555cad923cc3a8e6f397fc783abfec1ac (diff) | |
| parent | 5049aa2d74684d89a93b816f5cd75ca21896e510 (diff) | |
| download | wpa_supplicant_8-fa9a73bdd45dd9b88bacc4e0c53f63da7ecfe010.tar.gz | |
[automerger] WNM: Fix WNM-Sleep Mode Request bounds checking am: 7a543744db am: 4069976836 am: 5049aa2d74
Change-Id: I666d3c248598b589d5118e137b617323bf9f9017
| -rw-r--r-- | src/ap/wnm_ap.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c index 41d50ceb..02daa9bc 100644 --- a/src/ap/wnm_ap.c +++ b/src/ap/wnm_ap.c @@ -202,6 +202,13 @@ static void ieee802_11_rx_wnmsleep_req(struct hostapd_data *hapd, u8 *tfsreq_ie_end = NULL; u16 tfsreq_ie_len = 0; + if (len < 1) { + wpa_printf(MSG_DEBUG, + "WNM: Ignore too short WNM-Sleep Mode Request from " + MACSTR, MAC2STR(addr)); + return; + } + dialog_token = *pos++; while (pos + 1 < frm + len) { u8 ie_len = pos[1]; |