Merge branch 'bugfix/supplicant_memory_overflow' into 'master'

jack0c · jack0c · commit 19162d8754d4 · 2024-09-23T12:08:52.000+08:00
fix(esp_wifi): Prevent memory overflow in WPS

See merge request espressif/esp-idf!33712
diff --git a/components/wpa_supplicant/esp_supplicant/src/esp_wps.c b/components/wpa_supplicant/esp_supplicant/src/esp_wps.c
@@ -1394,7 +1394,7 @@ void wifi_station_wps_eapol_start_handle(void *data, void *user_ctx)
 static int save_credentials_cb(void *ctx, const struct wps_credential *cred)
 {
     struct wps_credential *creds;
-    if (!gWpsSm || !cred || gWpsSm->ap_cred_cnt > MAX_CRED_COUNT) {
+    if (!gWpsSm || !cred || gWpsSm->ap_cred_cnt >= MAX_CRED_COUNT) {
         return ESP_FAIL;
     }
 

Original file line number	Diff line number	Diff line change
`@@ -1394,7 +1394,7 @@ void wifi_station_wps_eapol_start_handle(void data, void user_ctx)`
`1394`	`1394`	`static int save_credentials_cb(void ctx, const struct wps_credential cred)`
`1395`	`1395`	`{`
`1396`	`1396`	`struct wps_credential *creds;`
`1397`		`- if (!gWpsSm \|\| !cred \|\| gWpsSm->ap_cred_cnt > MAX_CRED_COUNT) {`
	`1397`	`+ if (!gWpsSm \|\| !cred \|\| gWpsSm->ap_cred_cnt >= MAX_CRED_COUNT) {`
`1398`	`1398`	`return ESP_FAIL;`
`1399`	`1399`	`}`
`1400`	`1400`