Received-SPF: pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Markus Theil <markus.theil@tu-ilmenau.de>
To:     johannes@sipsolutions.net
Cc:     linux-wireless@vger.kernel.org,
        Markus Theil <markus.theil@tu-ilmenau.de>
Subject: [PATCH 2/2] iw: scan: better length checks in print_wifi_wps()
Date:   Mon, 10 Feb 2020 10:46:19 +0100
Message-Id: <20200210094619.14416-2-markus.theil@tu-ilmenau.de>
In-Reply-To: <20200210094619.14416-1-markus.theil@tu-ilmenau.de>
References: <20200210094619.14416-1-markus.theil@tu-ilmenau.de>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
---
 scan.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/scan.c b/scan.c
index a5beb0e..dbfe44c 100644
--- a/scan.c
+++ b/scan.c
@@ -1829,6 +1829,11 @@ static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data,
 		switch (subtype) {
 		case 0x104a:
 			tab_on_first(&first);
+			if (sublen < 1) {
+				printf("\t * Version: (invalid "
+				       "length %d)\n", sublen);
+				break;
+			}
 			printf("\t * Version: %d.%d\n", data[4] >> 4, data[4] & 0xF);
 			break;
 		case 0x1011:
@@ -1861,6 +1866,11 @@ static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data,
 			printf("\t * Model Number: %.*s\n", sublen, data + 4);
 			break;
 		case 0x103b: {
+			if (sublen < 1) {
+				printf("\t * Response Type: (invalid "
+				       "length %d)\n", sublen);
+				break;
+			}
 			__u8 val = data[4];
 			tab_on_first(&first);
 			printf("\t * Response Type: %d%s\n",
@@ -1874,6 +1884,11 @@ static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data,
 			break;
 		}
 		case 0x1041: {
+			if (sublen < 1) {
+				printf("\t * Selected Registrar: (invalid "
+				       "length %d)\n", sublen);
+				break;
+			}
 			__u8 val = data[4];
 			tab_on_first(&first);
 			printf("\t * Selected Registrar: 0x%x\n", val);
@@ -1884,6 +1899,11 @@ static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data,
 			printf("\t * Serial Number: %.*s\n", sublen, data + 4);
 			break;
 		case 0x1044: {
+			if (sublen < 1) {
+				printf("\t * Wi-Fi Protected Setup State: (invalid "
+				       "length %d)\n", sublen);
+				break;
+			}
 			__u8 val = data[4];
 			tab_on_first(&first);
 			printf("\t * Wi-Fi Protected Setup State: %d%s%s\n",
@@ -1928,6 +1948,11 @@ static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data,
 		}
 		case 0x1008:
 		case 0x1053: {
+			if (sublen < 2) {
+				printf("\t * Config methods: (invalid "
+				       "length %d)\n", sublen);
+				break;
+			}
 			__u16 meth = (data[4] << 8) + data[5];
 			bool comma = false;
 			tab_on_first(&first);
-- 
2.25.0