diff mbox series

iw: scan: more length checks for print_wifi_wps()

Message ID 20200210120635.498188-1-markus.theil@tu-ilmenau.de
State New
Headers show
Series iw: scan: more length checks for print_wifi_wps() | expand

Commit Message

Markus Theil Feb. 10, 2020, 12:06 p.m. UTC 
Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
---
 scan.c | 10 ++++++++++
 1 file changed, 10 insertions(+)
diff mbox series

Patch

diff --git a/scan.c b/scan.c
index dbfe44c..2dedd64 100644
--- a/scan.c
+++ b/scan.c
@@ -1878,6 +1878,11 @@  static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data,
 			break;
 		}
 		case 0x103c: {
+			if (sublen < 1) {
+				printf("\t * RF Bands: (invalid "
+				       "length %d)\n", sublen);
+				break;
+			}
 			__u8 val = data[4];
 			tab_on_first(&first);
 			printf("\t * RF Bands: 0x%x\n", val);
@@ -1941,6 +1946,11 @@  static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data,
 			break;
 		}
 		case 0x1057: {
+			if (sublen < 1) {
+				printf("\t * AP setup locked: (invalid "
+				       "length %d)\n", sublen);
+				break;
+			}
 			__u8 val = data[4];
 			tab_on_first(&first);
 			printf("\t * AP setup locked: 0x%.2x\n", val);