Security fix for out of bound read in p2p_invite
Check the p2p GO device address length before
sending the invite request to core supplicant.
Bug: 274443441
Test: Compile
Test: Manual - P2P persistent connection
Change-Id: I00f8ba9bea7bd36b52ae66250233230cac22ae83
diff --git a/wpa_supplicant/aidl/p2p_iface.cpp b/wpa_supplicant/aidl/p2p_iface.cpp
index 2afd75b..a48fcb3 100644
--- a/wpa_supplicant/aidl/p2p_iface.cpp
+++ b/wpa_supplicant/aidl/p2p_iface.cpp
@@ -1117,7 +1117,7 @@
const std::vector<uint8_t>& peer_address)
{
struct wpa_supplicant* wpa_s = retrieveIfacePtr();
- if (peer_address.size() != ETH_ALEN) {
+ if (go_device_address.size() != ETH_ALEN || peer_address.size() != ETH_ALEN) {
return {createStatus(SupplicantStatusCode::FAILURE_UNKNOWN)};
}
if (wpas_p2p_invite_group(