2020-02-10 12:07:28

by Markus Theil

[permalink] [raw]
Subject: [PATCH] iw: scan: more length checks for print_wifi_wps()

Signed-off-by: Markus Theil <[email protected]>
---
scan.c | 10 ++++++++++
1 file changed, 10 insertions(+)

diff --git a/scan.c b/scan.c
index dbfe44c..2dedd64 100644
--- a/scan.c
+++ b/scan.c
@@ -1878,6 +1878,11 @@ static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data,
break;
}
case 0x103c: {
+ if (sublen < 1) {
+ printf("\t * RF Bands: (invalid "
+ "length %d)\n", sublen);
+ break;
+ }
__u8 val = data[4];
tab_on_first(&first);
printf("\t * RF Bands: 0x%x\n", val);
@@ -1941,6 +1946,11 @@ static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data,
break;
}
case 0x1057: {
+ if (sublen < 1) {
+ printf("\t * AP setup locked: (invalid "
+ "length %d)\n", sublen);
+ break;
+ }
__u8 val = data[4];
tab_on_first(&first);
printf("\t * AP setup locked: 0x%.2x\n", val);
--
2.25.0