tree 233e4605cf0231626cb7997bf0fad77f0b5fdb59
parent 3fcbc190233c637776f8f7b3af56042128c31fed
author Hai Shalom <haishalom@google.com> 1614615114 -0800
committer android-build-team Robot <android-build-team-robot@google.com> 1617912362 +0000

P2P: Fix a corner case in peer addition based on PD Request

p2p_add_device() may remove the oldest entry if there is no room in the
peer table for a new peer. This would result in any pointer to that
removed entry becoming stale. A corner case with an invalid PD Request
frame could result in such a case ending up using (read+write) freed
memory. This could only by triggered when the peer table has reached its
maximum size and the PD Request frame is received from the P2P Device
Address of the oldest remaining entry and the frame has incorrect P2P
Device Address in the payload.

Fix this by fetching the dev pointer again after having called
p2p_add_device() so that the stale pointer cannot be used.

Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

Bug: 181489537
Test: Compiles

Merged-In: Ief7781491bd545fc1028b9b386fe7a4564102848
(cherry picked from commit c09ec815894987f8c0c65f8ab897b4068020593e)

Change-Id: Id4ea29314983350b34964f323527276ffcddf222
(cherry picked from commit 8b68d7983c6139cdc4f65ba14b4af5ef9e5c66b7)