diff options
| author | Jouni Malinen <j@w1.fi> | 2015-04-29 02:21:53 +0300 |
|---|---|---|
| committer | Gerrit Code Review <gerrit@cyanogenmod.org> | 2015-05-22 20:16:05 +0000 |
| commit | bc7e82d9c6f46b7cd37aa134240004e525302c5b (patch) | |
| tree | 22598a1ce500ce0d0e953fa2393e230618e2727e | |
| parent | 4d4d614ba37df22fdd0cfdebf1761fc6ba34327d (diff) | |
| download | android_external_wpa_supplicant_8-bc7e82d9c6f46b7cd37aa134240004e525302c5b.tar.gz android_external_wpa_supplicant_8-bc7e82d9c6f46b7cd37aa134240004e525302c5b.tar.bz2 android_external_wpa_supplicant_8-bc7e82d9c6f46b7cd37aa134240004e525302c5b.zip | |
AP WMM: Fix integer underflow in WMM Action frame parser
The length of the WMM Action frame was not properly validated and the
length of the information elements (int left) could end up being
negative. This would result in reading significantly past the stack
buffer while parsing the IEs in ieee802_11_parse_elems() and while doing
so, resulting in segmentation fault.
This can result in an invalid frame being used for a denial of service
attack (hostapd process killed) against an AP with a driver that uses
hostapd for management frame processing (e.g., all mac80211-based
drivers).
Thanks to Kostya Kortchinsky of Google security team for discovering and
reporting this issue.
Change-Id: I8f1f9734f74124df51eba4f075f7b9bc14af1332
Signed-off-by: Jouni Malinen <j@w1.fi>
| -rw-r--r-- | src/ap/wmm.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/ap/wmm.c b/src/ap/wmm.c index 6d4177c2..314e244b 100644 --- a/src/ap/wmm.c +++ b/src/ap/wmm.c @@ -274,6 +274,9 @@ void hostapd_wmm_action(struct hostapd_data *hapd, return; } + if (left < 0) + return; /* not a valid WMM Action frame */ + /* extract the tspec info element */ if (ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed) { hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, |