Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2024-11-25 00:38:24 -05:00
Code Issues Projects Releases Wiki Activity

D-Bus: Fix P2P DeleteService dict iteration

Browse Source 
The previous implementation assumed the first entry coming out from the
dict is always service_type. That may not be the case, so properly
iterate over all dict entries in one loop instead of assuming what the
first entry is.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2019-02-04 17:13:54 +02:00
parent 366ada0412
commit a68e9b6980
1 changed files with 17 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
wpa_supplicant/dbus/dbus_new_handlers_p2p.c
View File

@ -2693,7 +2693,7 @@ DBusMessage * wpas_dbus_handler_p2p_delete_service(
if (!wpa_dbus_dict_open_read(&iter, &iter_dict, NULL))
goto error;
if (wpa_dbus_dict_has_dict_entry(&iter_dict)) {
while (wpa_dbus_dict_has_dict_entry(&iter_dict)) {
if (!wpa_dbus_dict_get_entry(&iter_dict, &entry))
goto error;
@ -2705,27 +2705,27 @@ DBusMessage * wpas_dbus_handler_p2p_delete_service(
bonjour = 1;
else
goto error_clear;
} else if (os_strcmp(entry.key, "version") == 0 &&
entry.type == DBUS_TYPE_INT32) {
version = entry.uint32_value;
} else if (os_strcmp(entry.key, "service") == 0 &&
entry.type == DBUS_TYPE_STRING) {
os_free(service);
service = os_strdup(entry.str_value);
} else if (os_strcmp(entry.key, "query") == 0) {
if (entry.type != DBUS_TYPE_ARRAY ||
entry.array_type != DBUS_TYPE_BYTE)
goto error_clear;
wpabuf_free(query);
query = wpabuf_alloc_copy(entry.bytearray_value,
entry.array_len);
} else {
goto error_clear;
}
wpa_dbus_dict_entry_clear(&entry);
}
if (upnp == 1) {
while (wpa_dbus_dict_has_dict_entry(&iter_dict)) {
if (!wpa_dbus_dict_get_entry(&iter_dict, &entry))
goto error;
if (os_strcmp(entry.key, "version") == 0 &&
entry.type == DBUS_TYPE_INT32)
version = entry.uint32_value;
else if (os_strcmp(entry.key, "service") == 0 &&
entry.type == DBUS_TYPE_STRING) {
os_free(service);
service = os_strdup(entry.str_value);
} else
goto error_clear;
wpa_dbus_dict_entry_clear(&entry);
}
if (version <= 0 || service == NULL)
goto error;
@ -2733,24 +2733,6 @@ DBusMessage * wpas_dbus_handler_p2p_delete_service(
if (ret != 0)
goto error;
} else if (bonjour == 1) {
while (wpa_dbus_dict_has_dict_entry(&iter_dict)) {
if (!wpa_dbus_dict_get_entry(&iter_dict, &entry))
goto error;
if (os_strcmp(entry.key, "query") == 0) {
if (entry.type != DBUS_TYPE_ARRAY ||
entry.array_type != DBUS_TYPE_BYTE)
goto error_clear;
wpabuf_free(query);
query = wpabuf_alloc_copy(
entry.bytearray_value,
entry.array_len);
} else
goto error_clear;
wpa_dbus_dict_entry_clear(&entry);
}
if (query == NULL)
goto error;