Skip to content

Commit b6a5202

Browse files
moonlight83340danieldegrasse
authored andcommitted
modules: hostap: supp_api: Fix possible null deference
Ensure 'params' is not NULL before accessing its fields. Prevents possible null pointer dereference when calling strlen(params->ssid). Delay access to ssid->ssid and ssid->ssid_len until after null check. Prevents potential crash if wpa_s->current_ssid is NULL. Signed-off-by: Gaetan Perrot <gaetan.perrot@spacecubics.com>
1 parent 151295f commit b6a5202

File tree

1 file changed

+12
-4
lines changed

1 file changed

+12
-4
lines changed

modules/hostap/src/supp_api.c

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1291,8 +1291,8 @@ int supplicant_status(const struct device *dev, struct wifi_iface_status *status
12911291
struct wpa_ssid *ssid = wpa_s->current_ssid;
12921292
u8 channel;
12931293
struct signal_poll_resp signal_poll;
1294-
u8 *_ssid = ssid->ssid;
1295-
size_t ssid_len = ssid->ssid_len;
1294+
u8 *_ssid;
1295+
size_t ssid_len;
12961296
struct status_resp cli_status;
12971297
int proto;
12981298
int key_mgmt;
@@ -1303,6 +1303,8 @@ int supplicant_status(const struct device *dev, struct wifi_iface_status *status
13031303
goto out;
13041304
}
13051305

1306+
_ssid = ssid->ssid;
1307+
ssid_len = ssid->ssid_len;
13061308
proto = ssid->proto;
13071309
key_mgmt = ssid->key_mgmt;
13081310
sae_pwe = wpa_s->conf->sae_pwe;
@@ -1493,9 +1495,15 @@ int supplicant_11k_cfg(const struct device *dev, struct wifi_11k_params *params)
14931495

14941496
int supplicant_11k_neighbor_request(const struct device *dev, struct wifi_11k_params *params)
14951497
{
1496-
int ssid_len = strlen(params->ssid);
1498+
int ssid_len;
14971499

1498-
if (params != NULL && ssid_len > 0) {
1500+
if (params == NULL) {
1501+
return -1;
1502+
}
1503+
1504+
ssid_len = strlen(params->ssid);
1505+
1506+
if (ssid_len > 0) {
14991507
if (ssid_len > WIFI_SSID_MAX_LEN) {
15001508
wpa_printf(MSG_ERROR, "%s: ssid too long %u",
15011509
__func__, ssid_len);

0 commit comments

Comments
 (0)