jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Fix wpa_insert_pmkid() when buffer includes extra IEs

Browse source 
The case where the old RSNE included one or more PMKIDs and that RSNE
was followed by another IE was handled incorrectly since the
os_memmove() to move the end of the buffer when removing old PMKIDs was
stopping copying at the end of the RSNE, not the end of the IE buffer.
This could result in corrupting the IE that followed the RSNE. In
practice, this broke FT-SAE with H2E by corrupting the RSNXE that is in
the buffer after the RSNE.

Fix this by copying the full end of the buffer (i.e., including the
following RSNXE in the visible error case) when removing the old PMKIDs.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2019-12-24 18:54:38 +02:00
parent 6298673ff3
commit 4cfa8b92ba
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/common/wpa_common.c
View file

@ -2200,7 +2200,7 @@ int wpa_insert_pmkid(u8 *ies, size_t *ies_len, const u8 *pmkid)
"RSN: Remove %u old PMKID(s) from RSNE", "RSN: Remove %u old PMKID(s) from RSNE",
num_pmkid); num_pmkid);
after = rpos + 2 + num_pmkid * PMKID_LEN; after = rpos + 2 + num_pmkid * PMKID_LEN;
os_memmove(rpos + 2, after, rend - after); os_memmove(rpos + 2, after, end - after);
start[1] -= num_pmkid * PMKID_LEN; start[1] -= num_pmkid * PMKID_LEN;
added -= num_pmkid * PMKID_LEN; added -= num_pmkid * PMKID_LEN;
} }