Skip to content

Instantly share code, notes, and snippets.

@zdi-team
Created June 10, 2022 17:26
Show Gist options
  • Save zdi-team/cc7849f5614a801c43fa42d2dddd7e40 to your computer and use it in GitHub Desktop.
Save zdi-team/cc7849f5614a801c43fa42d2dddd7e40 to your computer and use it in GitHub Desktop.
// ‘ies’ can be overflown into, so we can fully control its contents
int
ieee80211_ies_init(struct ieee80211_ies *ies, const uint8_t *data, int len)
{
memset(ies, 0, offsetof(struct ieee80211_ies, data));
$0 if (ies->data != NULL && ies->len != len) { // <-- Ayy, we control these two fields
IEEE80211_FREE(ies->data, M_80211_NODE_IE);
ies->data = NULL;
}
if (ies->data == NULL) {
ies->data = (uint8_t *) IEEE80211_MALLOC(len, M_80211_NODE_IE,
IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
if (ies->data == NULL) {
ies->len = 0;
return 0;
}
}
$1 memcpy(ies->data, data, len); // <-- I believe in miracles
ies->len = len;
return 1;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment