]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
net80211: correct length check in ieee80211_ies_expand()
authorBjoern A. Zeeb <bz@FreeBSD.org>
Wed, 6 Oct 2021 18:09:39 +0000 (18:09 +0000)
committerBjoern A. Zeeb <bz@FreeBSD.org>
Fri, 19 Nov 2021 00:01:25 +0000 (00:01 +0000)
commit32c2c00e3f90d3a01a03ebdf7131c7e300da034c
treed22ae39078e57b97dd9f9019dc897d31a92d95f4
parentab5678c6c0d0b28feafdb2fd397866d6088f37d8
net80211: correct length check in ieee80211_ies_expand()

In ieee80211_ies_expand() we are looping over Elements
(also known as Information Elements or IEs).
The comment suggests that we assume well-formedness of
the IEs themselves.
Checking the buffer length being least 2 (1 byte Element ID and
1 byte Length fields) rather than just 1 before accessing ie[1]
is still good practise and can prevent and out-of-bounds read in
case the input is not behaving according to the comment.

Reported by: (coypu sdf.org)
admbugs: 857

(cherry picked from commit 09dd08f167812a5fdb516fc98f14dbb43221432f)
sys/net80211/ieee80211_node.c