diff mbox series

wpa_config_get_line can badly parse a password with # and "

Message ID CAPpUg6Mbgso5e=Ks8vXfj_JDa-Vk57fJUUbAJ5n-Ty9xjKMEBw@mail.gmail.com
State New
Headers show
Series wpa_config_get_line can badly parse a password with # and " | expand

Commit Message

Baptiste Clenet April 11, 2024, 2:18 p.m. UTC 
Hi,

Here is a password that wpa_config_get_line fails to parse
sae_password="0Y11D#E$4C"P/A;A4D#2x6D""

I made an example with several password on https://onlinegdb.com/9YFBl7Zba
By patch in this example I mentionned patch from xinpeng wang
(sha:aca4d4963a65e49614ed8cd52836a2619775c1f6)

I suggest to revert the patch and to not allow " in comment #
I didn't find any pattern that match my password and what xinpeng wang
wanted (a=b #"abc")

I attach a patch that revert xinpeng wang patch.

What do you think?
Feel free to include my patch, I'm not used to send patch as email

Thanks,
diff mbox series

Patch

diff --git a/src/utils/config.c b/src/utils/config.c
index ba26c2c..22aa221 100644
--- a/src/utils/config.c
+++ b/src/utils/config.c
@@ -66,20 +66,12 @@  char * wpa_config_get_line(char *s, int size, FILE *stream, int *line,
 		 * Remove # comments unless they are within a double quoted
 		 * string.
 		 */
-		sstart = pos;
+		sstart = os_strchr(pos, '"');
+		if (sstart)
+			sstart = os_strrchr(sstart + 1, '"');
+		if (!sstart)
+			sstart = pos;
 		end = os_strchr(sstart, '#');
-		while (end) {
-			sstart = os_strchr(sstart, '"');
-			if (!sstart || sstart > end)
-				break;
-			sstart = os_strchr(sstart + 1, '"');
-			if (!sstart)
-				break;
-			sstart++;
-			if (sstart > end)
-				end = os_strchr(sstart, '#');
-		}
-
 		if (end)
 			*end-- = '\0';
 		else