From 603d6b2881c25b4b9bca33ecf8e8a0d49c9b8840 Mon Sep 17 00:00:00 2001 From: James Prestwood Date: Wed, 16 Apr 2025 10:33:39 -0700 Subject: [PATCH] dpp-util: fail on duplicate values in URI The MAC and version elements weren't super critical but the channel and bootstrapping key elements would result in memory leaks if there were duplicates. This patch now will not allow duplicate elements in the URI. Fixes: f7f602e1b1e7 ("dpp-util: add URI parsing") --- src/dpp-util.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/dpp-util.c b/src/dpp-util.c index cfdedbdd..1986a5cc 100644 --- a/src/dpp-util.c +++ b/src/dpp-util.c @@ -1166,21 +1166,34 @@ struct dpp_uri_info *dpp_parse_uri(const char *uri) switch (*pos) { case 'C': + if (L_WARN_ON(info->freqs)) + goto free_info; + info->freqs = dpp_parse_class_and_channel(pos + 2, len); if (!info->freqs) goto free_info; break; case 'M': + if (L_WARN_ON(!l_memeqzero(info->mac, + sizeof(info->mac)))) + goto free_info; + ret = dpp_parse_mac(pos + 2, len, info->mac); if (ret < 0) goto free_info; break; case 'V': + if (L_WARN_ON(info->version != 0)) + goto free_info; + ret = dpp_parse_version(pos + 2, len, &info->version); if (ret < 0) goto free_info; break; case 'K': + if (L_WARN_ON(info->boot_public)) + goto free_info; + info->boot_public = dpp_parse_key(pos + 2, len); if (!info->boot_public) goto free_info;