From patchwork Fri Oct 11 10:51:47 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pontus Fuchs X-Patchwork-Id: 282709 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from maxx.maxx.shmoo.com (maxx.shmoo.com [205.134.188.171]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "maxx.shmoo.com", Issuer "CA Cert Signing Authority" (not verified)) by ozlabs.org (Postfix) with ESMTPS id 5DC872C00A6 for ; Fri, 11 Oct 2013 21:52:18 +1100 (EST) Received: from localhost (localhost [127.0.0.1]) by maxx.maxx.shmoo.com (Postfix) with ESMTP id 8CD639D258; Fri, 11 Oct 2013 06:52:15 -0400 (EDT) X-Virus-Scanned: amavisd-new at maxx.shmoo.com Received: from maxx.maxx.shmoo.com ([127.0.0.1]) by localhost (maxx.shmoo.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZKeHW4-2chDZ; Fri, 11 Oct 2013 06:52:15 -0400 (EDT) Received: from maxx.shmoo.com (localhost [127.0.0.1]) by maxx.maxx.shmoo.com (Postfix) with ESMTP id 01DE19D253; Fri, 11 Oct 2013 06:52:10 -0400 (EDT) X-Original-To: mailman-post+hostap@maxx.shmoo.com Delivered-To: mailman-post+hostap@maxx.shmoo.com Received: from localhost (localhost [127.0.0.1]) by maxx.maxx.shmoo.com (Postfix) with ESMTP id 0E2419D253 for ; Fri, 11 Oct 2013 06:52:09 -0400 (EDT) X-Virus-Scanned: amavisd-new at maxx.shmoo.com Received: from maxx.maxx.shmoo.com ([127.0.0.1]) by localhost (maxx.shmoo.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OpzOi4fyER7k for ; Fri, 11 Oct 2013 06:52:03 -0400 (EDT) Received: from mail-lb0-f177.google.com (mail-lb0-f177.google.com [209.85.217.177]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (not verified)) by maxx.maxx.shmoo.com (Postfix) with ESMTPS id C23F69D252 for ; Fri, 11 Oct 2013 06:52:02 -0400 (EDT) Received: by mail-lb0-f177.google.com with SMTP id w7so3134322lbi.8 for ; Fri, 11 Oct 2013 03:52:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=vFpmEWTea1RR18FmxcZGst8afjngf+GdFdUISWdR65s=; b=MLad9DDhj7IJskOUFcc9e9tgyeRAhmYaKYk0px0OwxQzIcFb1wowYhv+paL3DM+QMT 2Of080uaFcccNguPccbIQuma6JWx8bGDBLL5oTYhOgrek5Wnfs71U8e7HgRZd/MPC4/e xFPZnzM2EPva8VOIVCqArAQm7nXOG7C9gcugDANrgGxjxtbrsBp4w0JFBhxttfPldV7K LC0YMKO+aZhLphghrLKHeVWzrXJdD6+H17TKhA1YUJPXtdiN5zHP7SNcxm93rUW9NTIq 9laGSmgpetJ/Lh+QNYeweWCDKATQlAWsRl9m0oN5dr3dGlaPnfINWrIs5bSRGiN8GhLL mWmw== X-Received: by 10.152.115.176 with SMTP id jp16mr15702593lab.17.1381488720926; Fri, 11 Oct 2013 03:52:00 -0700 (PDT) Received: from localhost.localdomain (host-95-195-147-116.mobileonline.telia.com. [95.195.147.116]) by mx.google.com with ESMTPSA id zc3sm33040360lbb.2.1969.12.31.16.00.00 (version=TLSv1.1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 11 Oct 2013 03:51:59 -0700 (PDT) From: Pontus Fuchs To: hostap@lists.shmoo.com Subject: [PATCH] Increase buffer size and prevent write beyond buffer end Date: Fri, 11 Oct 2013 12:51:47 +0200 Message-Id: <1381488707-15762-1-git-send-email-pontus.fuchs@gmail.com> X-Mailer: git-send-email 1.8.1.2 Cc: pontus2.fuchs@sonymobile.com X-BeenThere: hostap@lists.shmoo.com X-Mailman-Version: 2.1.11 Precedence: list List-Id: HostAP Project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: hostap-bounces@lists.shmoo.com Errors-To: hostap-bounces@lists.shmoo.com wpa_config_write_key_mgmt has a buffer size of 50. This is not enough to fit the longest case. I used a network with "WPA-PSK WPA-EAP WPA-NONE" and CONFIG_IEEE80211R=y + CONFIG_IEEE80211W=y to produce a string longer than 50 chars. Increase the buffer size to 100 to prevent truncated output. Truncated output is not the only problem. If the buffer end is reached when adding certain key mgmt types the function does not return immediately. This leaves pos > end. When a second os_sprintf is called the calculation of end - pos yields a large positive number for buffer size. End result is a write beyond the buffer end. Fix this by bailing out if buffer end is reached. Signed-hostap: Pontus Fuchs --- wpa_supplicant/config.c | 64 ++++++++++++++++++++++++++++++++++++------------- 1 file changed, 47 insertions(+), 17 deletions(-) diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c index f8ebc0d..b25bd79 100644 --- a/wpa_supplicant/config.c +++ b/wpa_supplicant/config.c @@ -546,10 +546,10 @@ static char * wpa_config_write_key_mgmt(const struct parse_data *data, char *buf, *pos, *end; int ret; - pos = buf = os_zalloc(50); + pos = buf = os_zalloc(100); if (buf == NULL) return NULL; - end = buf + 50; + end = buf + 100; if (ssid->key_mgmt & WPA_KEY_MGMT_PSK) { ret = os_snprintf(pos, end - pos, "%sWPA-PSK", @@ -602,29 +602,59 @@ static char * wpa_config_write_key_mgmt(const struct parse_data *data, } #ifdef CONFIG_IEEE80211R - if (ssid->key_mgmt & WPA_KEY_MGMT_FT_PSK) - pos += os_snprintf(pos, end - pos, "%sFT-PSK", - pos == buf ? "" : " "); + if (ssid->key_mgmt & WPA_KEY_MGMT_FT_PSK) { + ret = os_snprintf(pos, end - pos, "%sFT-PSK", + pos == buf ? "" : " "); + if (ret < 0 || ret >= end - pos) { + end[-1] = '\0'; + return buf; + } + pos += ret; + } - if (ssid->key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) - pos += os_snprintf(pos, end - pos, "%sFT-EAP", - pos == buf ? "" : " "); + if (ssid->key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) { + ret = os_snprintf(pos, end - pos, "%sFT-EAP", + pos == buf ? "" : " "); + if (ret < 0 || ret >= end - pos) { + end[-1] = '\0'; + return buf; + } + pos += ret; + } #endif /* CONFIG_IEEE80211R */ #ifdef CONFIG_IEEE80211W - if (ssid->key_mgmt & WPA_KEY_MGMT_PSK_SHA256) - pos += os_snprintf(pos, end - pos, "%sWPA-PSK-SHA256", - pos == buf ? "" : " "); + if (ssid->key_mgmt & WPA_KEY_MGMT_PSK_SHA256) { + ret = os_snprintf(pos, end - pos, "%sWPA-PSK-SHA256", + pos == buf ? "" : " "); + if (ret < 0 || ret >= end - pos) { + end[-1] = '\0'; + return buf; + } + pos += ret; + } - if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) - pos += os_snprintf(pos, end - pos, "%sWPA-EAP-SHA256", - pos == buf ? "" : " "); + if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) { + ret = os_snprintf(pos, end - pos, "%sWPA-EAP-SHA256", + pos == buf ? "" : " "); + if (ret < 0 || ret >= end - pos) { + end[-1] = '\0'; + return buf; + } + pos += ret; + } #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_WPS - if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) - pos += os_snprintf(pos, end - pos, "%sWPS", - pos == buf ? "" : " "); + if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) { + ret = os_snprintf(pos, end - pos, "%sWPS", + pos == buf ? "" : " "); + if (ret < 0 || ret >= end - pos) { + end[-1] = '\0'; + return buf; + } + pos += ret; + } #endif /* CONFIG_WPS */ return buf;