Skip to content

Commit 46cbb1e

Browse files
moonlight83340krish2718
authored andcommitted
[nrf fromtree] modules: hostap: supp_api: Fix possible null deference
Ensure 'params' is not NULL before accessing its fields. Prevents possible null pointer dereference when calling strlen(params->ssid). Delay access to ssid->ssid and ssid->ssid_len until after null check. Prevents potential crash if wpa_s->current_ssid is NULL. Signed-off-by: Gaetan Perrot <[email protected]> (cherry picked from commit b6a5202)
1 parent d5a93e3 commit 46cbb1e

File tree

1 file changed

+12
-4
lines changed

1 file changed

+12
-4
lines changed

modules/hostap/src/supp_api.c

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1287,8 +1287,8 @@ int supplicant_status(const struct device *dev, struct wifi_iface_status *status
12871287
struct wpa_ssid *ssid = wpa_s->current_ssid;
12881288
u8 channel;
12891289
struct signal_poll_resp signal_poll;
1290-
u8 *_ssid = ssid->ssid;
1291-
size_t ssid_len = ssid->ssid_len;
1290+
u8 *_ssid;
1291+
size_t ssid_len;
12921292
struct status_resp cli_status;
12931293
int proto;
12941294
int key_mgmt;
@@ -1299,6 +1299,8 @@ int supplicant_status(const struct device *dev, struct wifi_iface_status *status
12991299
goto out;
13001300
}
13011301

1302+
_ssid = ssid->ssid;
1303+
ssid_len = ssid->ssid_len;
13021304
proto = ssid->proto;
13031305
key_mgmt = ssid->key_mgmt;
13041306
sae_pwe = wpa_s->conf->sae_pwe;
@@ -1489,9 +1491,15 @@ int supplicant_11k_cfg(const struct device *dev, struct wifi_11k_params *params)
14891491

14901492
int supplicant_11k_neighbor_request(const struct device *dev, struct wifi_11k_params *params)
14911493
{
1492-
int ssid_len = strlen(params->ssid);
1494+
int ssid_len;
14931495

1494-
if (params != NULL && ssid_len > 0) {
1496+
if (params == NULL) {
1497+
return -1;
1498+
}
1499+
1500+
ssid_len = strlen(params->ssid);
1501+
1502+
if (ssid_len > 0) {
14951503
if (ssid_len > WIFI_SSID_MAX_LEN) {
14961504
wpa_printf(MSG_ERROR, "%s: ssid too long %u",
14971505
__func__, ssid_len);

0 commit comments

Comments
 (0)