Skip to content

Commit 8453386

Browse files
committed
wifi/esp32: Fix overflow in SSID copy
In the previous code, strnlen could have returned WIFI_SSID_MAX_LEN, and the following statement ensuring NUL termination would have written one past the end of the array. Replace this with code that ensures a NUL termination within the bounds of the array and then use strlen to compute the length. Signed-off-by: Keith Packard <[email protected]>
1 parent 9ee0bc9 commit 8453386

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

drivers/wifi/esp32/src/esp_wifi_drv.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -770,8 +770,10 @@ static int esp32_wifi_status(const struct device *dev, struct wifi_iface_status
770770
}
771771

772772
strncpy(status->ssid, data->status.ssid, WIFI_SSID_MAX_LEN);
773-
status->ssid_len = strnlen(data->status.ssid, WIFI_SSID_MAX_LEN);
774-
status->ssid[status->ssid_len] = '\0';
773+
/* Ensure the result is NUL terminated */
774+
status->ssid[WIFI_SSID_MAX_LEN-1] = '\0';
775+
/* We know it is NUL terminated, so we can use strlen */
776+
status->ssid_len = strlen(data->status.ssid);
775777
status->band = WIFI_FREQ_BAND_2_4_GHZ;
776778
status->link_mode = WIFI_LINK_MODE_UNKNOWN;
777779
status->mfp = WIFI_MFP_DISABLE;

0 commit comments

Comments
 (0)