Changeset 1409

Timestamp:

01/23/06 11:16:49 (3 years ago)

Author:

svens

Message:

Add sanity checks to ieee80211_recv_mgmt(): check boundaries of
elements before accessing it, and also ignore packets where the sum of
all single element lengths is greater than the whole packet.

Files:

• trunk/net80211/ieee80211_input.c (modified) (8 diffs)

trunk/net80211/ieee80211_input.c

@@ -2252 +2252 @@
-
-                while (frm < efrm) {
+                        IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
-                        switch (*frm) {
-                        case IEEE80211_ELEMID_SSID:
@@ -2323 +2324 @@
-                        frm += frm[1] + 2;
-                }
+                if(frm > efrm)
+                        return;
-                IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE);
-                IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN);
@@ -2520 +2523 @@
-                while (frm < efrm) {
-                        switch (*frm) {
+                                IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
-                        case IEEE80211_ELEMID_SSID:
-                                ssid = frm;
@@ -2537 +2541 @@
-                        frm += frm[1] + 2;
-                }
+                if(frm > efrm)
+                        return;
-                IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
-                IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
@@ -2718 +2724 @@
-                ssid = rates = xrates = wpa = rsn = wme = ath = NULL;
-                while (frm < efrm) {
+                        IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
-                        switch (*frm) {
-                        case IEEE80211_ELEMID_SSID:
@@ -2759 +2766 @@
-                        frm += frm[1] + 2;
-                }
+                if(frm > efrm)
+                        return;
-                IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
-                IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
@@ -2998 +3007 @@
-                while (frm < efrm) {
-                        switch (*frm) {
+                                IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
-                        case IEEE80211_ELEMID_RATES:
-                                rates = frm;
@@ -3011 +3021 @@
-                        frm += frm[1] + 2;
-                }
-
+
+
-                IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
-                rate = ieee80211_setup_rates(ni, rates, xrates,