diff options
authorJouni Malinen <>2018-10-29 20:48:07 +0200
committerVeerendranath Jakkam <>2019-01-29 12:43:35 +0000
commitc8d215c57c049ed7015ded342ebaaef21b438425 (patch)
parentd35a3df1b355d1fd7a2bf3188145cc9de4267433 (diff)
WNM: Fix WNM-Sleep Mode Request bounds checking
ieee802_11_rx_wnmsleep_req() might have been called for a short frame that has no more payload after the Public Action field, i.e., with len == 0. The bounds checking for the payload length was done only for the information elements while the one octet Dialog Token field was read unconditionally. In the original implementation, this could have resulted in reading one octet beyond the end of the received frame data. This case has not been reachable after the commit e0785ebbbd18 ("Use more consistent Action frame RX handling in both AP mode paths"), but it is better to address the specific issue in ieee802_11_rx_wnmsleep_req() as well for additional protection against accidential removal of the check and also to have something that can be merged into an older version (pre-v2.7) if desired. The comments below apply for such older versions where the case could have been reachable. Depending on driver interface specific mechanism used for fetching the frame, this could result in reading one octet beyond the end of a stack/hash buffer or reading an uninitialized octet from within a buffer. The actual value that was read as the Dialog Token field is not used since the function returns immediately after having read this value when there is no information elements following the field. This issue was initially added in commit d32d94dbf47a ("WNM: Add WNM-Sleep Mode implementation for AP") (with CONFIG_IEEE80211V=y build option) and it remained in place during number of cleanup and fix changes in this area and renaming of the build parameter to CONFIG_WNM=y. The impacted function was not included in any default build without one of the these optional build options being explicitly enabled. CONFIG_WNM=y is still documented as "experimental and not complete implementation" in hostapd/defconfig. In addition, commit 114f2830d2c2 ("WNM: Ignore WNM-Sleep Mode Request in wnm_sleep_mode=0 case") made this function exit before the impact read if WNM-Sleep Mode support was not explicitly enabled in runtime configuration (wnm_sleep_mode=1 in hostapd.conf). Commit e0785ebbbd18 ("Use more consistent Action frame RX handling in both AP mode paths") made this code unreachable in practice. Add an explicit check that the frame has enough payload before reading the Dialog Token field in ieee802_11_rx_wnmsleep_req(). Signed-off-by: Jouni Malinen <> CRs-Fixed: 2389239 Git-repo : git:// Git-commit: e34cd9f06e7cbb11e07180ad5301c099eb162810 Change-Id: I2f2e621323a073e9eefe24c2b0b92b5bd7d15d2f
1 files changed, 7 insertions, 0 deletions
diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
index 710fe50..7b43c7d 100644
--- a/src/ap/wnm_ap.c
+++ b/src/ap/wnm_ap.c
@@ -209,6 +209,13 @@ static void ieee802_11_rx_wnmsleep_req(struct hostapd_data *hapd,
+ if (len < 1) {
+ wpa_printf(MSG_DEBUG,
+ "WNM: Ignore too short WNM-Sleep Mode Request from "
+ MACSTR, MAC2STR(addr));
+ return;
+ }
dialog_token = *pos++;
while (pos + 1 < frm + len) {
u8 ie_len = pos[1];