[NXP][platform][common] add WPA3 support #39411
Open
+10
−2
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Martin Girardot <[email protected]>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request aims to add WPA3-SAE support for NXP platforms by updating how Wi-Fi network credentials are provisioned. The core change involves populating a new password field in the network security structure, intended for WPA3's potentially longer passwords, alongside the existing psk field.
While adding WPA3 support is a valuable enhancement, the current implementation has critical memory safety concerns. Specifically, there are potential buffer overflows when copying the key to both the psk and the new password fields if the provided keyLen exceeds their respective buffer capacities. These issues need to be addressed before merging.
Summary of Findings
- Potential Buffer Overflow in
pskfield copy: ThememcpytopNetworkData->security.psk(line 645) can cause a buffer overflow ifkeyLen(now potentially for a longer WPA3 password) exceeds thepskbuffer's capacity. This is a critical memory safety issue. - Potential Buffer Overflow in new
passwordfield copy: The newly addedmemcpytopNetworkData->security.password(line 648) can also cause a buffer overflow ifkeyLenexceeds thepasswordbuffer's capacity. This also needs to be safeguarded to prevent memory corruption.
Merge Readiness
This pull request introduces important WPA3 support. However, there are critical buffer overflow vulnerabilities identified in the way network keys are copied. These issues must be addressed to ensure memory safety before the PR can be considered for merging. As an AI reviewer, I am not authorized to approve pull requests; please ensure these changes are reviewed and approved by other maintainers after the identified issues are resolved.
|
PR #39411: Size comparison from 0a6c200 to 4c8586c Full report (14 builds for cc13x4_26x4, cc32xx, nrfconnect, qpg, stm32, tizen)
|
Martin-NXP
force-pushed
the
nxp_upstream_wpa3_support
branch
2 times, most recently
from
06d7494 to
93c0bfc
Compare
|
PR #39411: Size comparison from d74efe3 to 8ce4ae9 Increases above 0.2%:
Full report (70 builds for bl602, bl702, bl702l, cc13x4_26x4, cc32xx, cyw30739, efr32, esp32, linux, nrfconnect, nxp, psoc6, stm32, telink, tizen)
|
chapongatien
approved these changes
Jun 6, 2025
tcarmelveilleux
requested changes
Jun 6, 2025
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Signed-off-by: Martin Girardot <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Add WPA3-SAE support for NXP platforms
Testing
Wifi commissioning using WPA3-SAE security AP, rw61x NXP platform