jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

eap_proxy: Fix memory leaks when using eap_peer_erp_init()

Browse source 
The external session_id and emsk from eap_proxy_get_eap_session_id() and
eap_proxy_get_emsk() need to be freed consistently in all code paths
within eap_peer_erp_init() and outside it in the case ERP is not
initialized.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit is contained in:
Srikanth Marepalli 2018-09-20 13:26:07 +05:30 committed by Jouni Malinen
parent 820ea0ba93
commit bd88ed60fa
2 changed files with 13 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
src/eap_peer/eap.c
View file

@ -670,6 +670,9 @@ void eap_peer_erp_free_keys(struct eap_sm *sm)
} }
/* Note: If ext_session and/or ext_emsk are passed to this function, they are
* expected to point to allocated memory and those allocations will be freed
* unconditionally. */
void eap_peer_erp_init(struct eap_sm *sm, u8 *ext_session_id, void eap_peer_erp_init(struct eap_sm *sm, u8 *ext_session_id,
size_t ext_session_id_len, u8 *ext_emsk, size_t ext_session_id_len, u8 *ext_emsk,
size_t ext_emsk_len) size_t ext_emsk_len)
@ -688,7 +691,7 @@ void eap_peer_erp_init(struct eap_sm *sm, u8 *ext_session_id,
realm = eap_home_realm(sm); realm = eap_home_realm(sm);
if (!realm) if (!realm)
return; goto fail;
realm_len = os_strlen(realm); realm_len = os_strlen(realm);
wpa_printf(MSG_DEBUG, "EAP: Realm for ERP keyName-NAI: %s", realm); wpa_printf(MSG_DEBUG, "EAP: Realm for ERP keyName-NAI: %s", realm);
eap_erp_remove_keys_realm(sm, realm); eap_erp_remove_keys_realm(sm, realm);
@ -775,7 +778,10 @@ void eap_peer_erp_init(struct eap_sm *sm, u8 *ext_session_id,
dl_list_add(&sm->erp_keys, &erp->list); dl_list_add(&sm->erp_keys, &erp->list);
erp = NULL; erp = NULL;
fail: fail:
bin_clear_free(emsk, emsk_len); if (ext_emsk)
bin_clear_free(ext_emsk, ext_emsk_len);
else
bin_clear_free(emsk, emsk_len);
bin_clear_free(ext_session_id, ext_session_id_len); bin_clear_free(ext_session_id, ext_session_id_len);
bin_clear_free(erp, sizeof(*erp)); bin_clear_free(erp, sizeof(*erp));
os_free(realm); os_free(realm);

6
src/eapol_supp/eapol_supp_sm.c
View file

@ -503,10 +503,14 @@ SM_STATE(SUPP_BE, SUCCESS)
session_id = eap_proxy_get_eap_session_id( session_id = eap_proxy_get_eap_session_id(
sm->eap_proxy, &session_id_len); sm->eap_proxy, &session_id_len);
emsk = eap_proxy_get_emsk(sm->eap_proxy, &emsk_len); emsk = eap_proxy_get_emsk(sm->eap_proxy, &emsk_len);
if (sm->config->erp && session_id && emsk) if (sm->config->erp && session_id && emsk) {
eap_peer_erp_init(sm->eap, session_id, eap_peer_erp_init(sm->eap, session_id,
session_id_len, emsk, session_id_len, emsk,
emsk_len); emsk_len);
} else {
os_free(session_id);
bin_clear_free(emsk, emsk_len);
}
} }
return; return;
} }