Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2024-11-25 08:48:31 -05:00
Code Issues Projects Releases Wiki Activity

Fix Linux packat socket regression work around

Browse Source 
Commit e6dd8196e5 ('Work around Linux
packet socket regression') added a mechanism to close the workaround
bridge socket in l2_packet_receive(). However, it did not take into
account the possibility of the l2->rx_callback() closing the l2_packet
socket altogether. This could result in use of freed memory when usin
RSN pre-authentication. Fix this by reordering the calls to clear the
workaround socket before calling the rx_callback.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2015-02-07 01:13:34 +02:00
parent d821e2f294
commit 23ed011bea
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/l2_packet/l2_packet_linux.c
View File

@ -132,8 +132,6 @@ static void l2_packet_receive(int sock, void *eloop_ctx, void *sock_ctx)
return; return;
} }
l2->rx_callback(l2->rx_callback_ctx, ll.sll_addr, buf, res);
if (l2->fd_br_rx >= 0) { if (l2->fd_br_rx >= 0) {
wpa_printf(MSG_DEBUG, "l2_packet_receive: Main packet socket for %s seems to have working RX - close workaround bridge socket", wpa_printf(MSG_DEBUG, "l2_packet_receive: Main packet socket for %s seems to have working RX - close workaround bridge socket",
l2->ifname); l2->ifname);
@ -141,6 +139,8 @@ static void l2_packet_receive(int sock, void *eloop_ctx, void *sock_ctx)
close(l2->fd_br_rx); close(l2->fd_br_rx);
l2->fd_br_rx = -1; l2->fd_br_rx = -1;
} }
l2->rx_callback(l2->rx_callback_ctx, ll.sll_addr, buf, res);
} }