mirror of
https://github.com/vanhoefm/fragattacks.git
synced 2024-11-28 18:28:23 -05:00
af9d709019
When parsing a dict entry which is an array of an array of bytes the entry representing the dict entry has DBUS_TYPE_ARRAY as its type and WPAS_DBUS_TYPE_ARRAY as its array_type. The function freeing this parsed data incorrectly tested the entry type for WPAS_DBUS_TYPE_ARRAY while doing no testing of this value for array_type. This results in a memory leak whenever a D-Bus message with this type of data is parsed. Messages affected are: fi.w1.wpa_supplicant1.Interface.P2PDevice using RequestedDeviceTypes with Find method using SecondaryDeviceTypes or VendorExtension with P2PDeviceProperties fi.w1.wpa_supplicant1.Group using WPSVendorExtensions with Properties property All of the above messages are parsed with the same function, wpa_dbus_dict_get_entry, so the assignment of the entry's type and array_type is consistent. The parsed data is also consistently freed with the same function, wpa_dbus_dict_entry_clear, so we can use the same checks to free the data correctly. Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: Angie Chinchilla <angie.v.chinchilla@intel.com> |
||
|---|---|---|
| .. | ||
| .gitignore | ||
| dbus_common_i.h | ||
| dbus_common.c | ||
| dbus_common.h | ||
| dbus_dict_helpers.c | ||
| dbus_dict_helpers.h | ||
| dbus_new_handlers_p2p.c | ||
| dbus_new_handlers_p2p.h | ||
| dbus_new_handlers_wps.c | ||
| dbus_new_handlers.c | ||
| dbus_new_handlers.h | ||
| dbus_new_helpers.c | ||
| dbus_new_helpers.h | ||
| dbus_new_introspect.c | ||
| dbus_new.c | ||
| dbus_new.h | ||
| dbus_old_handlers_wps.c | ||
| dbus_old_handlers.c | ||
| dbus_old_handlers.h | ||
| dbus_old.c | ||
| dbus_old.h | ||
| dbus-wpa_supplicant.conf | ||
| fi.epitest.hostap.WPASupplicant.service.in | ||
| fi.w1.wpa_supplicant1.service.in | ||
| Makefile | ||