jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

EAP-SIM peer: Fix counter-too-small message building

Browse source 
The extra data (nonce_s) used in this message was pointing to the
parsed, decrypted data and that buffer was previously freed just before
building the new message. This resulted in use of freed data and
possibly incorrect extra data value that caused the authentication
attempt to fail. Fix this by reordering the code to free the decrypted
data only after the new message has been generated. This was already the
case for EAP-AKA/AKA', but somehow missing from EAP-SIM.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2014-05-11 17:54:59 +03:00
parent 32dca985c7
commit 04cad507e1
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/eap_peer/eap_sim.c
View file

@ -952,9 +952,11 @@ static struct wpabuf * eap_sim_process_reauthentication(
}
if (eattr.counter < 0 || (size_t) eattr.counter <= data->counter) {
struct wpabuf *res;
wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid counter "
"(%d <= %d)", eattr.counter, data->counter);
data->counter_too_small = eattr.counter;
/* Reply using Re-auth w/ AT_COUNTER_TOO_SMALL. The current
* reauth_id must not be used to start a new reauthentication.
* However, since it was used in the last EAP-Response-Identity
@ -965,8 +967,11 @@ static struct wpabuf * eap_sim_process_reauthentication(
data->last_eap_identity_len = data->reauth_id_len;
data->reauth_id = NULL;
data->reauth_id_len = 0;
res = eap_sim_response_reauth(data, id, 1, eattr.nonce_s);
os_free(decrypted);
return eap_sim_response_reauth(data, id, 1, eattr.nonce_s);
return res;
}
data->counter = eattr.counter;