commit e6747a12928845398fe963c9b522acb4aedc075b
author TreeHugger Robot <treehugger-gerrit@google.com> Tue Feb 05 08:51:39 2019 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Tue Feb 05 08:51:39 2019 +0000
tree fcd62236b41c2ce5b04923ba7a5a0213c8397ead
parent 9373a1112c8d5843c38c6d3a3cb3e8c0a853e886
parent cb95c3f41acb3bcdd6477b59f945554bc1849465

Merge "[wpa_supplicant] Fix security vulnerability wpa_supplicant/wnm_sta.c:376"

wpa_supplicant/wnm_sta.c

diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
index 6b68fc9..912f4c4 100644
--- a/wpa_supplicant/wnm_sta.c
+++ b/wpa_supplicant/wnm_sta.c
@@ -376,6 +376,10 @@
 		rep->preference_present = 1;
 		break;
 	case WNM_NEIGHBOR_BSS_TERMINATION_DURATION:
+		if (elen < 10) {
+			wpa_printf(MSG_DEBUG, "WNM: Too short bss_term_tsf");
+			break;
+		}
 		rep->bss_term_tsf = WPA_GET_LE64(pos);
 		rep->bss_term_dur = WPA_GET_LE16(pos + 8);
 		rep->bss_term_present = 1;