wpa_supplicant: Add WPS ssid length validation
@@ -397,6 +397,7 @@ wps_parse_scan_result(struct wps_scan_ie *scan)
for (count = 0; count < WPS_MAX_DIS_AP_NUM; count++) {
if (os_memcmp(sm->dis_ap_list[count].bssid, scan->bssid, ETH_ALEN) == 0) {
wpa_printf(MSG_INFO, "discard ap bssid "MACSTR, MAC2STR(scan->bssid));
+ wpabuf_free(buf);
return false;
}
}
@@ -404,6 +405,9 @@ wps_parse_scan_result(struct wps_scan_ie *scan)
if (ap_found || sm->ignore_sel_reg) {
wpabuf_free(buf);
+ if (scan->ssid[1] > SSID_MAX_LEN) {
+ return false;
+ }
esp_wifi_enable_sta_privacy_internal();
os_memset(sm->ssid[0], 0, SSID_MAX_LEN);
os_memcpy(sm->ssid[0], (char *)&scan->ssid[2], (int)scan->ssid[1]);
