Kernel/iwd
3
0
Fork 0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-11-22 06:29:23 +01:00
Code Releases Activity

p2putil: check length of client info description

Browse Source 
A length check was missing which could cause a out of bounds read.

Co-authored-by: Alex Radocea <alex@supernetworks.org>
This commit is contained in:
James Prestwood 2024-02-29 09:07:34 -08:00 committed by Denis Kenzior
parent d34b4e16e0
commit 83c032a583
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/p2putil.c
View File

@ -376,6 +376,9 @@ static bool extract_p2p_group_info(const uint8_t *attr, size_t len,
desc = l_new(struct p2p_client_info_descriptor, 1); desc = l_new(struct p2p_client_info_descriptor, 1);
l_queue_push_tail(*out, desc); l_queue_push_tail(*out, desc);
if (desc_len < 24)
goto error;
memcpy(desc->device_addr, attr + 0, 6); memcpy(desc->device_addr, attr + 0, 6);
memcpy(desc->interface_addr, attr + 6, 6); memcpy(desc->interface_addr, attr + 6, 6);
desc->device_caps = attr[12]; desc->device_caps = attr[12];