Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2024-11-28 10:18:21 -05:00
Code Issues Projects Releases Wiki Activity

BSS/scan: More conversions to for_each_element_id()

Browse Source 
Use the common IE parsing routine in hope of trying to make the length
checks easier for static analyzers. In addition, try to make the
*_vendor_ie_multi() cases easier to analyze as well even though they
cannot use for_each_element_id().

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit is contained in:
Jouni Malinen 2020-11-04 19:50:34 +02:00 committed by Jouni Malinen
parent aa06444f2c
commit f4de21a77a
2 changed files with 45 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
wpa_supplicant/bss.c
View File

@ -1184,22 +1184,20 @@ const u8 * wpa_bss_get_vendor_ie(const struct wpa_bss *bss, u32 vendor_type)
const u8 * wpa_bss_get_vendor_ie_beacon(const struct wpa_bss *bss, const u8 * wpa_bss_get_vendor_ie_beacon(const struct wpa_bss *bss,
u32 vendor_type) u32 vendor_type)
{ {
const u8 *end, *pos; const u8 *ies;
const struct element *elem;
if (bss->beacon_ie_len == 0) if (bss->beacon_ie_len == 0)
return NULL; return NULL;
pos = (const u8 *) (bss + 1); ies = (const u8 *) (bss + 1);
pos += bss->ie_len; ies += bss->ie_len;
end = pos + bss->beacon_ie_len;
while (end - pos > 1) { for_each_element_id(elem, WLAN_EID_VENDOR_SPECIFIC, ies,
if (2 + pos[1] > end - pos) bss->beacon_ie_len) {
break; if (elem->datalen >= 4 &&
if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 && vendor_type == WPA_GET_BE32(elem->data))
vendor_type == WPA_GET_BE32(&pos[2])) return &elem->id;
return pos;
pos += 2 + pos[1];
} }
return NULL; return NULL;
@ -1230,12 +1228,17 @@ struct wpabuf * wpa_bss_get_vendor_ie_multi(const struct wpa_bss *bss,
end = pos + bss->ie_len; end = pos + bss->ie_len;
while (end - pos > 1) { while (end - pos > 1) {
if (2 + pos[1] > end - pos) u8 ie, len;
ie = pos[0];
len = pos[1];
if (len > end - pos - 2)
break; break;
if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 && pos += 2;
vendor_type == WPA_GET_BE32(&pos[2])) if (ie == WLAN_EID_VENDOR_SPECIFIC && len >= 4 &&
wpabuf_put_data(buf, pos + 2 + 4, pos[1] - 4); vendor_type == WPA_GET_BE32(pos))
pos += 2 + pos[1]; wpabuf_put_data(buf, pos + 4, len - 4);
pos += len;
} }
if (wpabuf_len(buf) == 0) { if (wpabuf_len(buf) == 0) {

52
wpa_supplicant/scan.c
View File

@ -1869,18 +1869,15 @@ const u8 * wpa_scan_get_ie(const struct wpa_scan_res *res, u8 ie)
const u8 * wpa_scan_get_vendor_ie(const struct wpa_scan_res *res, const u8 * wpa_scan_get_vendor_ie(const struct wpa_scan_res *res,
u32 vendor_type) u32 vendor_type)
{ {
const u8 *end, *pos; const u8 *ies;
const struct element *elem;
pos = (const u8 *) (res + 1); ies = (const u8 *) (res + 1);
end = pos + res->ie_len;
while (end - pos > 1) { for_each_element_id(elem, WLAN_EID_VENDOR_SPECIFIC, ies, res->ie_len) {
if (2 + pos[1] > end - pos) if (elem->datalen >= 4 &&
break; vendor_type == WPA_GET_BE32(elem->data))
if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 && return &elem->id;
vendor_type == WPA_GET_BE32(&pos[2]))
return pos;
pos += 2 + pos[1];
} }
return NULL; return NULL;
@ -1902,22 +1899,20 @@ const u8 * wpa_scan_get_vendor_ie(const struct wpa_scan_res *res,
const u8 * wpa_scan_get_vendor_ie_beacon(const struct wpa_scan_res *res, const u8 * wpa_scan_get_vendor_ie_beacon(const struct wpa_scan_res *res,
u32 vendor_type) u32 vendor_type)
{ {
const u8 *end, *pos; const u8 *ies;
const struct element *elem;
if (res->beacon_ie_len == 0) if (res->beacon_ie_len == 0)
return NULL; return NULL;
pos = (const u8 *) (res + 1); ies = (const u8 *) (res + 1);
pos += res->ie_len; ies += res->ie_len;
end = pos + res->beacon_ie_len;
while (end - pos > 1) { for_each_element_id(elem, WLAN_EID_VENDOR_SPECIFIC, ies,
if (2 + pos[1] > end - pos) res->beacon_ie_len) {
break; if (elem->datalen >= 4 &&
if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 && vendor_type == WPA_GET_BE32(elem->data))
vendor_type == WPA_GET_BE32(&pos[2])) return &elem->id;
return pos;
pos += 2 + pos[1];
} }
return NULL; return NULL;
@ -1948,12 +1943,17 @@ struct wpabuf * wpa_scan_get_vendor_ie_multi(const struct wpa_scan_res *res,
end = pos + res->ie_len; end = pos + res->ie_len;
while (end - pos > 1) { while (end - pos > 1) {
if (2 + pos[1] > end - pos) u8 ie, len;
ie = pos[0];
len = pos[1];
if (len > end - pos - 2)
break; break;
if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 && pos += 2;
vendor_type == WPA_GET_BE32(&pos[2])) if (ie == WLAN_EID_VENDOR_SPECIFIC && len >= 4 &&
wpabuf_put_data(buf, pos + 2 + 4, pos[1] - 4); vendor_type == WPA_GET_BE32(pos))
pos += 2 + pos[1]; wpabuf_put_data(buf, pos + 4, len - 4);
pos += len;
} }
if (wpabuf_len(buf) == 0) { if (wpabuf_len(buf) == 0) {