[PATCH] Fix for checking go intent value before going ahead for processing of Go Neg Request Frame

[Rahul Jain]

Signed-off-by: Rahul Jain <rahul.jain at samsung.com>
---
 src/p2p/p2p_go_neg.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/p2p/p2p_go_neg.c b/src/p2p/p2p_go_neg.c
index 2e40db1..c6b47be 100644
--- a/src/p2p/p2p_go_neg.c
+++ b/src/p2p/p2p_go_neg.c
@@ -545,8 +545,14 @@ void p2p_process_go_neg_req(struct p2p_data *p2p, const u8 *sa,
 #endif /* CONFIG_P2P_STRICT */
 	}
 
-	if (msg.go_intent)
+	if (msg.go_intent) {
 		tie_breaker = *msg.go_intent & 0x01;
+		if ((*msg.go_intent >> 1) > P2P_MAX_GO_INTENT) {
+			p2p_dbg(p2p, "Invalid GO Intent value (%u) received",
+				*msg.go_intent >> 1);
+			goto fail;
+		}
+	}
 	else {
 		p2p_dbg(p2p, "Mandatory GO Intent attribute missing from GO Negotiation Request");
 #ifdef CONFIG_P2P_STRICT
-- 
1.7.9.5

Thanks
-Rahul Jain
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Fix-for-checking-go-intent-value-before-going-ahead-.patch
Type: application/octet-stream
Size: 1047 bytes
Desc: not available
URL: <http://lists.shmoo.com/pipermail/hostap/attachments/20140221/ee2d8e89/attachment.obj>