michaelh/zephyr
1
0
Fork 0
Code Releases Activity

drivers: wifi: eswifi: Fix parsing buffer-overflows

Browse source 
There are possible buffer overflows when parsing the ip address and
SSID. Ensure that we never overwrite the ip and SSID buffers.

Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
This commit is contained in:
Loic Poulain 2020-07-08 09:22:33 +02:00 • committed by Jukka Rissanen
commit 40e2d94bc8
1 changed files with 16 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

32
drivers/wifi/eswifi/eswifi_core.c
View file

@ -52,29 +52,30 @@ static int eswifi_reset(struct eswifi_dev *eswifi)
static inline int __parse_ssid(char *str, char *ssid) static inline int __parse_ssid(char *str, char *ssid)
{ {
/* fnt => '"SSID"' */ int i = 0;
if (!*str || (*str != '"')) { /* fmt => "SSID" */
return -EINVAL;
}
str++;
while (*str && (*str != '"')) {
*ssid++ = *str++;
}
*ssid = '\0';
if (*str != '"') { if (*str != '"') {
return -EINVAL; return 0;
}
str++;
while (*str && (*str != '"') && i < WIFI_SSID_MAX_LEN) {
ssid[i++] = *str++;
} }
return -EINVAL; if (*str != '"') {
return 0;
}
return i;
} }
static void __parse_scan_res(char *str, struct wifi_scan_result *res) static void __parse_scan_res(char *str, struct wifi_scan_result *res)
{ {
int field = 0; int field = 0;
int ret;
/* fmt => #001,"SSID",MACADDR,RSSI,BITRATE,MODE,SECURITY,BAND,CHANNEL */ /* fmt => #001,"SSID",MACADDR,RSSI,BITRATE,MODE,SECURITY,BAND,CHANNEL */
@ -90,8 +91,7 @@ static void __parse_scan_res(char *str, struct wifi_scan_result *res)
switch (++field) { switch (++field) {
case 1: /* SSID */ case 1: /* SSID */
__parse_ssid(str, res->ssid); res->ssid_length = __parse_ssid(str, res->ssid);
res->ssid_length = strlen(res->ssid);
str += res->ssid_length; str += res->ssid_length;
break; break;
case 2: /* mac addr */ case 2: /* mac addr */
@ -180,7 +180,7 @@ static int __parse_ipv4_address(char *str, char *ssid, uint8_t ip[4])
unsigned int byte = -1; unsigned int byte = -1;
/* fmt => [JOIN ] SSID,192.168.2.18,0,0 */ /* fmt => [JOIN ] SSID,192.168.2.18,0,0 */
while (*str) { while (*str && byte < 4) {
if (byte == -1) { if (byte == -1) {
if (!strncmp(str, ssid, strlen(ssid))) { if (!strncmp(str, ssid, strlen(ssid))) {
byte = 0U; byte = 0U;