HomeFreeBSD

net80211: correct length check in ieee80211_ies_expand()

Description

net80211: correct length check in ieee80211_ies_expand()

In ieee80211_ies_expand() we are looping over Elements
(also known as Information Elements or IEs).
The comment suggests that we assume well-formedness of
the IEs themselves.
Checking the buffer length being least 2 (1 byte Element ID and
1 byte Length fields) rather than just 1 before accessing ie[1]
is still good practise and can prevent and out-of-bounds read in
case the input is not behaving according to the comment.

Reported by: (coypu sdf.org)
admbugs: 857
MFC after: 3 days
Reviewed by: adrian, markj
Differential Revision: https://reviews.freebsd.org/D32340

Details

Provenance
bzAuthored on Oct 6 2021, 6:09 PM
Reviewer
adrian
Differential Revision
D32340: net80211: correct length check in ieee80211_ies_expand()
Parents
R10:526370fb85db: net80211: proper ssid length check in setmlme_assoc_adhoc()
Branches
Unknown
Tags
Unknown