wext: Check hexstr2bin() return value in custom scan text processing

diff --git a/src/drivers/driver_wext.c b/src/drivers/driver_wext.c
index cb89a9e..3fe1329 100644 (file)
--- a/src/drivers/driver_wext.c
+++ b/src/drivers/driver_wext.c
@@ -1133,8 +1133,9 @@ static void wext_get_scan_custom(struct iw_event *iwe,
                tmp = os_realloc(res->ie, res->ie_len + bytes);
                if (tmp == NULL)
                        return;
-               hexstr2bin(spos, tmp + res->ie_len, bytes);
                res->ie = tmp;
+               if (hexstr2bin(spos, tmp + res->ie_len, bytes) < 0)
+                       return;
                res->ie_len += bytes;
        } else if (clen > 7 && os_strncmp(custom, "rsn_ie=", 7) == 0) {
                char *spos;
@@ -1147,8 +1148,9 @@ static void wext_get_scan_custom(struct iw_event *iwe,
                tmp = os_realloc(res->ie, res->ie_len + bytes);
                if (tmp == NULL)
                        return;
-               hexstr2bin(spos, tmp + res->ie_len, bytes);
                res->ie = tmp;
+               if (hexstr2bin(spos, tmp + res->ie_len, bytes) < 0)
+                       return;
                res->ie_len += bytes;
        } else if (clen > 4 && os_strncmp(custom, "tsf=", 4) == 0) {
                char *spos;
@@ -1161,7 +1163,10 @@ static void wext_get_scan_custom(struct iw_event *iwe,
                        return;
                }
                bytes /= 2;
-               hexstr2bin(spos, bin, bytes);
+               if (hexstr2bin(spos, bin, bytes) < 0) {
+                       wpa_printf(MSG_DEBUG, "WEXT: Invalid TSF value");
+                       return;
+               }
                res->res.tsf += WPA_GET_BE64(bin);
        }
 }