Browse Source

TDLS: Validate ext_supp_rates in copy_supp_rates

The ext_supp_rates passed to merge_byte_arrays would be invalid if not
advertized by the TDLS peer. Thus, validate the argument to avoid
crashes in such cases.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
Sunil Dutt 11 years ago
parent
commit
87436760a2
1 changed files with 2 additions and 1 deletions
  1. 2 1
      src/rsn_supp/tdls.c

+ 2 - 1
src/rsn_supp/tdls.c

@@ -1347,7 +1347,8 @@ static int copy_supp_rates(const struct wpa_eapol_ie_parse *kde,
 	peer->supp_rates_len = merge_byte_arrays(
 		peer->supp_rates, sizeof(peer->supp_rates),
 		kde->supp_rates + 2, kde->supp_rates_len - 2,
-		kde->ext_supp_rates + 2, kde->ext_supp_rates_len - 2);
+		kde->ext_supp_rates ? kde->ext_supp_rates + 2 : NULL,
+		kde->ext_supp_rates_len - 2);
 	return 0;
 }