From: James Prestwood <prestwoj@gmail.com>
To: iwd@lists.linux.dev
Cc: James Prestwood <prestwoj@gmail.com>
Subject: [PATCH 4/5] p2putil: initialize all parsing structures to zero
Date: Thu, 29 Feb 2024 09:07:33 -0800 [thread overview]
Message-ID: <20240229170734.1498918-4-prestwoj@gmail.com> (raw)
In-Reply-To: <20240229170734.1498918-1-prestwoj@gmail.com>
Since these are all stack variables they are not zero initialized.
If parsing fails there may be invalid pointers within the structures
which can get dereferenced by p2p_clear_*
---
src/p2putil.c | 34 +++++++++++++++++-----------------
1 file changed, 17 insertions(+), 17 deletions(-)
diff --git a/src/p2putil.c b/src/p2putil.c
index faf151a5..c90810e5 100644
--- a/src/p2putil.c
+++ b/src/p2putil.c
@@ -776,7 +776,7 @@ done:
/* Section 4.2.1 */
int p2p_parse_beacon(const uint8_t *pdu, size_t len, struct p2p_beacon *out)
{
- struct p2p_beacon d = {};
+ struct p2p_beacon d = {0};
int r;
r = p2p_parse_attrs(pdu, len,
@@ -797,7 +797,7 @@ int p2p_parse_beacon(const uint8_t *pdu, size_t len, struct p2p_beacon *out)
int p2p_parse_probe_req(const uint8_t *pdu, size_t len,
struct p2p_probe_req *out)
{
- struct p2p_probe_req d = {};
+ struct p2p_probe_req d = {0};
int r;
r = p2p_parse_attrs(pdu, len,
@@ -828,7 +828,7 @@ int p2p_parse_probe_req(const uint8_t *pdu, size_t len,
int p2p_parse_probe_resp(const uint8_t *pdu, size_t len,
struct p2p_probe_resp *out)
{
- struct p2p_probe_resp d = {};
+ struct p2p_probe_resp d = {0};
int r;
r = p2p_parse_attrs(pdu, len,
@@ -853,7 +853,7 @@ int p2p_parse_probe_resp(const uint8_t *pdu, size_t len,
int p2p_parse_association_req(const uint8_t *pdu, size_t len,
struct p2p_association_req *out)
{
- struct p2p_association_req d = {};
+ struct p2p_association_req d = {0};
int r;
r = p2p_parse_attrs(pdu, len,
@@ -876,7 +876,7 @@ int p2p_parse_association_req(const uint8_t *pdu, size_t len,
int p2p_parse_association_resp(const uint8_t *pdu, size_t len,
struct p2p_association_resp *out)
{
- struct p2p_association_resp d = {};
+ struct p2p_association_resp d = {0};
int r;
r = p2p_parse_attrs(pdu, len,
@@ -939,7 +939,7 @@ int p2p_parse_disassociation(const uint8_t *pdu, size_t len,
int p2p_parse_go_negotiation_req(const uint8_t *pdu, size_t len,
struct p2p_go_negotiation_req *out)
{
- struct p2p_go_negotiation_req d = {};
+ struct p2p_go_negotiation_req d = {0};
int r;
struct p2p_go_intent_attr go_intent;
uint8_t *wsc_data;
@@ -1001,7 +1001,7 @@ error:
int p2p_parse_go_negotiation_resp(const uint8_t *pdu, size_t len,
struct p2p_go_negotiation_resp *out)
{
- struct p2p_go_negotiation_resp d = {};
+ struct p2p_go_negotiation_resp d = {0};
int r;
struct p2p_go_intent_attr go_intent;
uint8_t *wsc_data;
@@ -1062,7 +1062,7 @@ error:
int p2p_parse_go_negotiation_confirmation(const uint8_t *pdu, size_t len,
struct p2p_go_negotiation_confirmation *out)
{
- struct p2p_go_negotiation_confirmation d = {};
+ struct p2p_go_negotiation_confirmation d = {0};
int r;
if (len < 1)
@@ -1096,7 +1096,7 @@ error:
int p2p_parse_invitation_req(const uint8_t *pdu, size_t len,
struct p2p_invitation_req *out)
{
- struct p2p_invitation_req d = {};
+ struct p2p_invitation_req d = {0};
int r;
uint8_t *wsc_data;
ssize_t wsc_len;
@@ -1151,7 +1151,7 @@ error:
int p2p_parse_invitation_resp(const uint8_t *pdu, size_t len,
struct p2p_invitation_resp *out)
{
- struct p2p_invitation_resp d = {};
+ struct p2p_invitation_resp d = {0};
int r;
if (len < 1)
@@ -1185,7 +1185,7 @@ error:
int p2p_parse_device_disc_req(const uint8_t *pdu, size_t len,
struct p2p_device_discoverability_req *out)
{
- struct p2p_device_discoverability_req d = {};
+ struct p2p_device_discoverability_req d = {0};
int r;
if (len < 1)
@@ -1210,7 +1210,7 @@ int p2p_parse_device_disc_req(const uint8_t *pdu, size_t len,
int p2p_parse_device_disc_resp(const uint8_t *pdu, size_t len,
struct p2p_device_discoverability_resp *out)
{
- struct p2p_device_discoverability_resp d = {};
+ struct p2p_device_discoverability_resp d = {0};
int r;
if (len < 1)
@@ -1234,7 +1234,7 @@ int p2p_parse_device_disc_resp(const uint8_t *pdu, size_t len,
int p2p_parse_provision_disc_req(const uint8_t *pdu, size_t len,
struct p2p_provision_discovery_req *out)
{
- struct p2p_provision_discovery_req d = {};
+ struct p2p_provision_discovery_req d = {0};
int r;
uint8_t *wsc_data;
ssize_t wsc_len;
@@ -1309,7 +1309,7 @@ error:
int p2p_parse_provision_disc_resp(const uint8_t *pdu, size_t len,
struct p2p_provision_discovery_resp *out)
{
- struct p2p_provision_discovery_resp d = {};
+ struct p2p_provision_discovery_resp d = {0};
int r;
uint8_t *wsc_data;
ssize_t wsc_len;
@@ -1389,7 +1389,7 @@ error:
int p2p_parse_notice_of_absence(const uint8_t *pdu, size_t len,
struct p2p_notice_of_absence *out)
{
- struct p2p_notice_of_absence d = {};
+ struct p2p_notice_of_absence d = {0};
int r;
if (len < 1)
@@ -1411,7 +1411,7 @@ int p2p_parse_notice_of_absence(const uint8_t *pdu, size_t len,
int p2p_parse_presence_req(const uint8_t *pdu, size_t len,
struct p2p_presence_req *out)
{
- struct p2p_presence_req d = {};
+ struct p2p_presence_req d = {0};
int r;
if (len < 1)
@@ -1437,7 +1437,7 @@ int p2p_parse_presence_req(const uint8_t *pdu, size_t len,
int p2p_parse_presence_resp(const uint8_t *pdu, size_t len,
struct p2p_presence_resp *out)
{
- struct p2p_presence_resp d = {};
+ struct p2p_presence_resp d = {0};
int r;
if (len < 1)
--
2.34.1
next prev parent reply other threads:[~2024-02-29 17:07 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-29 17:07 [PATCH 1/5] auto-t: end process_io on HUP signal, detect process crash James Prestwood
2024-02-29 17:07 ` [PATCH 2/5] auto-t: Add frame fuzzing test James Prestwood
2024-02-29 17:07 ` [PATCH 3/5] p2putil: fix crash/remove side effect parsing adv service info James Prestwood
2024-02-29 17:07 ` James Prestwood [this message]
2024-02-29 17:07 ` [PATCH 5/5] p2putil: check length of client info description James Prestwood
2024-02-29 20:36 ` [PATCH 1/5] auto-t: end process_io on HUP signal, detect process crash Denis Kenzior
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240229170734.1498918-4-prestwoj@gmail.com \
--to=prestwoj@gmail.com \
--cc=iwd@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox