From 83c032a58357f968382c942e676f463ceac5e37a Mon Sep 17 00:00:00 2001 From: James Prestwood Date: Thu, 29 Feb 2024 09:07:34 -0800 Subject: [PATCH] p2putil: check length of client info description A length check was missing which could cause a out of bounds read. Co-authored-by: Alex Radocea --- src/p2putil.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/p2putil.c b/src/p2putil.c index c90810e5..d1f114d0 100644 --- a/src/p2putil.c +++ b/src/p2putil.c @@ -376,6 +376,9 @@ static bool extract_p2p_group_info(const uint8_t *attr, size_t len, desc = l_new(struct p2p_client_info_descriptor, 1); l_queue_push_tail(*out, desc); + if (desc_len < 24) + goto error; + memcpy(desc->device_addr, attr + 0, 6); memcpy(desc->interface_addr, attr + 6, 6); desc->device_caps = attr[12];