Page MenuHomeFreeBSD

net80211: correct length check in ieee80211_ies_expand()
ClosedPublic

Authored by bz on Oct 6 2021, 6:28 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Jul 4, 10:45 PM
Unknown Object (File)
Sat, Jul 4, 11:01 AM
Unknown Object (File)
Fri, Jul 3, 11:02 PM
Unknown Object (File)
Fri, Jul 3, 1:00 PM
Unknown Object (File)
Fri, Jul 3, 6:00 AM
Unknown Object (File)
Fri, Jul 3, 12:42 AM
Unknown Object (File)
Thu, Jul 2, 2:43 PM
Unknown Object (File)
Thu, Jun 25, 8:28 AM

Details

Summary

In ieee80211_ies_expand() we are looping over Elements
(also known as Information Elements or IEs).
The comment suggests that we assume well-formedness of
the IEs themselves.
Checking the buffer length being least 2 (1 byte Element ID and
1 byte Length fields) rather than just 1 before accessing ie[1]
is still good practise and can prevent and out-of-bounds read in
case the input is not behaving according to the comment.

Reported by: (coypu sdf.org)
admbugs: 857
MFC after: 3 days

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 41987
Build 38875: arc lint + arc unit