jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

EAP-MSCHAPv2: Check hash function results more consistently (CID 68105)

Browse source 
While the hash functions would be very unlikely to fail in practice,
they do have option of returning an error. Check that return value more
consistently.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2014-06-14 01:01:18 +03:00
parent b7c61c9d4e
commit 2485835ba3
1 changed files with 21 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
src/eap_peer/eap_mschapv2.c
View file

@ -309,10 +309,13 @@ static void eap_mschapv2_password_changed(struct eap_sm *sm,
} else if (config->flags & EAP_CONFIG_FLAGS_PASSWORD_NTHASH) {
config->password = os_malloc(16);
config->password_len = 16;
if (config->password) {
if (config->password &&
nt_password_hash(config->new_password,
config->new_password_len,
config->password);
config->password)) {
os_free(config->password);
config->password = NULL;
config->password_len = 0;
}
os_free(config->new_password);
} else {
@ -549,15 +552,17 @@ static struct wpabuf * eap_mschapv2_change_password(
/* Encrypted-Hash */
if (pwhash) {
u8 new_password_hash[16];
nt_password_hash(new_password, new_password_len,
new_password_hash);
if (nt_password_hash(new_password, new_password_len,
new_password_hash))
goto fail;
nt_password_hash_encrypted_with_block(password,
new_password_hash,
cp->encr_hash);
} else {
old_nt_password_hash_encrypted_with_new_nt_password_hash(
if (old_nt_password_hash_encrypted_with_new_nt_password_hash(
new_password, new_password_len,
password, password_len, cp->encr_hash);
password, password_len, cp->encr_hash))
goto fail;
}
/* Peer-Challenge */
@ -594,9 +599,13 @@ static struct wpabuf * eap_mschapv2_change_password(
/* Likewise, generate master_key here since we have the needed data
* available. */
nt_password_hash(new_password, new_password_len, password_hash);
hash_nt_password_hash(password_hash, password_hash_hash);
get_master_key(password_hash_hash, cp->nt_response, data->master_key);
if (nt_password_hash(new_password, new_password_len, password_hash) ||
hash_nt_password_hash(password_hash, password_hash_hash) ||
get_master_key(password_hash_hash, cp->nt_response,
data->master_key)) {
data->auth_response_valid = 0;
goto fail;
}
data->master_key_valid = 1;
/* Flags */