jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

mesh: Fix error path handling for RSN (MGTK init)

Browse source 
wpa_deinit() got called twice if the random_get_bytes() fails to
generate the MGTK. This resulted in double-freeing the rsn->auth
pointer. Fix this by allowing mesh_rsn_auth_init() handle freeing for
all error cases.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Jouni Malinen 2016-05-30 20:15:16 +03:00 committed by Jouni Malinen
parent 4d4cdc3bb2
commit b4c738ec86
1 changed files with 1 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
wpa_supplicant/mesh_rsn.c
View file

@ -167,10 +167,8 @@ static int __mesh_rsn_auth_init(struct mesh_rsn *rsn, const u8 *addr)
}
/* TODO: support rekeying */
if (random_get_bytes(rsn->mgtk, 16) < 0) {
wpa_deinit(rsn->auth);
if (random_get_bytes(rsn->mgtk, 16) < 0)
return -1;
}
/* group mgmt */
wpa_drv_set_key(rsn->wpa_s, WPA_ALG_IGTK, NULL, 4, 1,