jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

FILS: Do not leave error value in left counter

Browse source 
If fils_decrypt_assoc() were to fail on the AP side, the previous
implementation could have continued through the response generation
using left = -1. That could have resulted in unexpected processing if
this value were to be used as the length of the remaining (unencrypted)
IEs. Fix this by not updating left in the failure case.

Fixes: 78815f3dde ("FILS: Decrypt Association Request elements and check Key-Auth (AP)")
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Jouni Malinen 2017-11-24 12:21:18 +02:00 committed by Jouni Malinen
parent beae255a72
commit 1489fcf87d
1 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/ap/ieee802_11.c
View file

@ -3221,6 +3221,8 @@ static void handle_assoc(struct hostapd_data *hapd,
if (sta->auth_alg == WLAN_AUTH_FILS_SK ||
sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
sta->auth_alg == WLAN_AUTH_FILS_PK) {
int res;
/* The end of the payload is encrypted. Need to decrypt it
* before parsing. */
@ -3230,13 +3232,14 @@ static void handle_assoc(struct hostapd_data *hapd,
goto fail;
}
left = fils_decrypt_assoc(sta->wpa_sm, sta->fils_session, mgmt,
res = fils_decrypt_assoc(sta->wpa_sm, sta->fils_session, mgmt,
len, tmp, left);
if (left < 0) {
if (res < 0) {
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
goto fail;
}
pos = tmp;
left = res;
}
#endif /* CONFIG_FILS */