arne/openwrt
1
0
Fork 0
forked from mirror/openwrt
Code Pull requests Activity

hostapd: ubus: fix beacon request buffer overflow with reporting detail

Browse source 
The reporting detail subelement (up to 3 bytes) was not accounted for
in the wpabuf allocation, causing a crash when reporting_detail is set
to a valid value (0, 1, or 2).

Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
Felix Fietkau 2026-03-18 15:58:37 +00:00
parent 06125fc10d
commit 0208089ded
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
package/network/services/hostapd/src/src/ap/ubus.c
View file

@ -1212,6 +1212,9 @@ hostapd_rrm_beacon_req(struct ubus_context *ctx, struct ubus_object *obj,
if (tb[BEACON_REQ_REPORTING_DETAIL])
reporting_detail = blobmsg_get_u32(tb[BEACON_REQ_REPORTING_DETAIL]);
if (reporting_detail >= 0 && reporting_detail < 3)
buf_len += 3;
req = wpabuf_alloc(buf_len);
if (!req)
return UBUS_STATUS_UNKNOWN_ERROR;