|
 |
5a6a09 |
From c5f258de76dbb67fb64beab39a99e5c5711f41fe Mon Sep 17 00:00:00 2001
|
|
|
5a6a09 |
From: Jouni Malinen <jouni@qca.qualcomm.com>
|
|
|
5a6a09 |
Date: Mon, 6 Oct 2014 17:25:52 +0300
|
|
|
5a6a09 |
Subject: [PATCH 2/2] wpa_cli: Use os_exec() for action script execution
|
|
|
5a6a09 |
|
|
|
5a6a09 |
Use os_exec() to run the action script operations to avoid undesired
|
|
|
5a6a09 |
command line processing for control interface event strings. Previously,
|
|
|
5a6a09 |
it could have been possible for some of the event strings to include
|
|
|
5a6a09 |
unsanitized data which is not suitable for system() use. (CVE-2014-3686)
|
|
|
5a6a09 |
|
|
|
5a6a09 |
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
|
|
|
5a6a09 |
---
|
|
|
5a6a09 |
wpa_supplicant/wpa_cli.c | 25 ++++++++-----------------
|
|
|
5a6a09 |
1 file changed, 8 insertions(+), 17 deletions(-)
|
|
|
5a6a09 |
|
|
|
5a6a09 |
diff --git a/wpa_supplicant/wpa_cli.c b/wpa_supplicant/wpa_cli.c
|
|
|
5a6a09 |
index 18b9b77..fe30b41 100644
|
|
|
5a6a09 |
--- a/wpa_supplicant/wpa_cli.c
|
|
|
5a6a09 |
+++ b/wpa_supplicant/wpa_cli.c
|
|
|
5a6a09 |
@@ -3155,36 +3155,27 @@ static int str_match(const char *a, const char *b)
|
|
|
5a6a09 |
return os_strncmp(a, b, os_strlen(b)) == 0;
|
|
|
5a6a09 |
}
|
|
|
5a6a09 |
|
|
|
5a6a09 |
|
|
|
5a6a09 |
static int wpa_cli_exec(const char *program, const char *arg1,
|
|
|
5a6a09 |
const char *arg2)
|
|
|
5a6a09 |
{
|
|
|
5a6a09 |
- char *cmd;
|
|
|
5a6a09 |
+ char *arg;
|
|
|
5a6a09 |
size_t len;
|
|
|
5a6a09 |
int res;
|
|
|
5a6a09 |
- int ret = 0;
|
|
|
5a6a09 |
|
|
|
5a6a09 |
- len = os_strlen(program) + os_strlen(arg1) + os_strlen(arg2) + 3;
|
|
|
5a6a09 |
- cmd = os_malloc(len);
|
|
|
5a6a09 |
- if (cmd == NULL)
|
|
|
5a6a09 |
+ len = os_strlen(arg1) + os_strlen(arg2) + 2;
|
|
|
5a6a09 |
+ arg = os_malloc(len);
|
|
|
5a6a09 |
+ if (arg == NULL)
|
|
|
5a6a09 |
return -1;
|
|
|
5a6a09 |
- res = os_snprintf(cmd, len, "%s %s %s", program, arg1, arg2);
|
|
|
5a6a09 |
- if (res < 0 || (size_t) res >= len) {
|
|
|
5a6a09 |
- os_free(cmd);
|
|
|
5a6a09 |
- return -1;
|
|
|
5a6a09 |
- }
|
|
|
5a6a09 |
- cmd[len - 1] = '\0';
|
|
|
5a6a09 |
-#ifndef _WIN32_WCE
|
|
|
5a6a09 |
- if (system(cmd) < 0)
|
|
|
5a6a09 |
- ret = -1;
|
|
|
5a6a09 |
-#endif /* _WIN32_WCE */
|
|
|
5a6a09 |
- os_free(cmd);
|
|
|
5a6a09 |
+ os_snprintf(arg, len, "%s %s", arg1, arg2);
|
|
|
5a6a09 |
+ res = os_exec(program, arg, 1);
|
|
|
5a6a09 |
+ os_free(arg);
|
|
|
5a6a09 |
|
|
|
5a6a09 |
- return ret;
|
|
|
5a6a09 |
+ return res;
|
|
|
5a6a09 |
}
|
|
|
5a6a09 |
|
|
|
5a6a09 |
|
|
|
5a6a09 |
static void wpa_cli_action_process(const char *msg)
|
|
|
5a6a09 |
{
|
|
|
5a6a09 |
const char *pos;
|
|
|
5a6a09 |
char *copy = NULL, *id, *pos2;
|
|
|
5a6a09 |
--
|
|
|
5a6a09 |
1.9.3
|
|
|
5a6a09 |
|