Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2024-11-25 00:38:24 -05:00
Code Issues Projects Releases Wiki Activity

MSCS: Fix issues due to incorrect usage of wpa_hexdump_buf()

Browse Source 
Previously wpabuf_head() of the buffer is passed to wpa_hexdump_buf()
instead of the wpabuf struct itself and it was causing wpa_supplicant to
crash. Fix this by using the correct pointer in the debug prints.

Fixes: a118047245 ("MSCS: Add support to send MSCS Request frames")
Fixes: c504ff5398 ("MSCS: Add support to populate MSCS Descriptor IE in (Re)AssocReq")
Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
This commit is contained in:
Veerendranath Jakkam 2020-08-19 15:00:32 +05:30 committed by Jouni Malinen
parent 0f84a56219
commit 93a73ce028
3 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
wpa_supplicant/robust_av.c
View File

@ -94,7 +94,7 @@ int wpas_send_mscs_req(struct wpa_supplicant *wpa_s)
/* MSCS descriptor element */
wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, buf);
wpa_hexdump_buf(MSG_MSGDUMP, "MSCS Request", wpabuf_head(buf));
wpa_hexdump_buf(MSG_MSGDUMP, "MSCS Request", buf);
ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
wpa_s->own_addr, wpa_s->bssid,
wpabuf_head(buf), wpabuf_len(buf), 0);

3
wpa_supplicant/sme.c
View File

@ -1905,8 +1905,7 @@ pfs_fail:
max_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, mscs_ie);
if ((*wpa_ie_len + wpabuf_len(mscs_ie)) <= max_ie_len) {
wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE",
wpabuf_head(mscs_ie));
wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE", mscs_ie);
mscs_ie_len = wpabuf_len(mscs_ie);
os_memcpy(wpa_s->sme.assoc_req_ie + *wpa_ie_len,
wpabuf_head(mscs_ie), mscs_ie_len);

3
wpa_supplicant/wpa_supplicant.c
View File

@ -3214,8 +3214,7 @@ pfs_fail:
wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, mscs_ie);
if ((wpa_ie_len + wpabuf_len(mscs_ie)) <= max_wpa_ie_len) {
wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE",
wpabuf_head(mscs_ie));
wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE", mscs_ie);
mscs_ie_len = wpabuf_len(mscs_ie);
os_memcpy(wpa_ie + wpa_ie_len, wpabuf_head(mscs_ie),
mscs_ie_len);