mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-07-20 17:47:14 +00:00
Hitendra Prajapati
acbbb1e308
Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/4b48ee36f1829d6d3d009bf9871af523ce8e3ace Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
66 lines
2.6 KiB
Diff
66 lines
2.6 KiB
Diff
From 4b48ee36f1829d6d3d009bf9871af523ce8e3ace Mon Sep 17 00:00:00 2001
|
|
From: John Thacker <johnthacker@gmail.com>
|
|
Date: Sat, 10 Jan 2026 08:33:35 -0500
|
|
Subject: [PATCH] ieee80211: Avoid using a fixed array for multi-link per-STA
|
|
subelements
|
|
|
|
Since this processes to the end of the TVB, there might be more than 16.
|
|
Simplify the logic and only test for a set link_id in one place. This
|
|
also gets rid of a possible use of an uninitialized value on error.
|
|
|
|
Fix #20939, OSS-Fuzz 474458885
|
|
|
|
CVE: CVE-2026-0959
|
|
Upstream-Status: Backport [https://gitlab.com/wireshark/wireshark/-/commit/4b48ee36f1829d6d3d009bf9871af523ce8e3ace]
|
|
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
|
---
|
|
epan/dissectors/packet-ieee80211.c | 12 ++----------
|
|
1 file changed, 2 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/epan/dissectors/packet-ieee80211.c b/epan/dissectors/packet-ieee80211.c
|
|
index 0371e21..15e89f7 100644
|
|
--- a/epan/dissectors/packet-ieee80211.c
|
|
+++ b/epan/dissectors/packet-ieee80211.c
|
|
@@ -27911,7 +27911,7 @@ dissect_multi_link(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree,
|
|
guint8 multi_link_type = multi_link_control & 0x0007;
|
|
guint16 present = multi_link_control >> 4;
|
|
int elt = 0, hf_index;
|
|
- int local_link_ids[16];
|
|
+ wmem_strbuf_t *link_id_list = wmem_strbuf_create(pinfo->pool);
|
|
|
|
control = proto_tree_add_item(tree, hf_ieee80211_eht_multi_link_control, tvb,
|
|
offset, 2, ENC_LITTLE_ENDIAN);
|
|
@@ -28194,9 +28194,6 @@ dissect_multi_link(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree,
|
|
multi_link_type, &link_id);
|
|
|
|
offset += overhead; /* Account for the overhead in the subelt */
|
|
- if (link_id != -1) {
|
|
- local_link_ids[elt] = link_id;
|
|
- }
|
|
break;
|
|
case 221:
|
|
/* Add an expert info saying there are none so far? */
|
|
@@ -28207,18 +28204,13 @@ dissect_multi_link(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree,
|
|
break;
|
|
}
|
|
if (link_id != -1) {
|
|
+ wmem_strbuf_append_printf(link_id_list, (elt == 0) ? "%d" : "_%d", link_id);
|
|
elt++;
|
|
}
|
|
}
|
|
proto_tree_add_uint(tree, hf_index, tvb, 0, 0, elt);
|
|
|
|
if (elt) {
|
|
- wmem_strbuf_t *link_id_list = wmem_strbuf_new_sized(pinfo->pool, elt * 2);
|
|
- for (int i = 0; i < elt; i++) {
|
|
- if (local_link_ids[i] != -1) {
|
|
- wmem_strbuf_append_printf(link_id_list, (i == 0) ? "%d" : "_%d", local_link_ids[i]);
|
|
- }
|
|
- }
|
|
proto_tree_add_string(tree, hf_ieee80211_eht_multi_link_link_id_list, tvb,
|
|
0, 0, link_id_list->str);
|
|
}
|
|
--
|
|
2.50.1
|
|
|