jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

EAP-FAST: Fix an error path in PAC binary format parsing

Browse source 
Need to clear the pac pointer for the first error case to avoid freeing
the previous PAC entry if the following entry has an invalid header.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Jouni Malinen 2016-02-06 00:26:31 +02:00 committed by Jouni Malinen
parent f91e11f465
commit e265838a43
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/eap_peer/eap_fast_pac.c
View file

@ -802,8 +802,10 @@ int eap_fast_load_pac_bin(struct eap_sm *sm, struct eap_fast_pac **pac_root,
while (pos < end) {
u16 val;
if (end - pos < 2 + EAP_FAST_PAC_KEY_LEN + 2 + 2)
if (end - pos < 2 + EAP_FAST_PAC_KEY_LEN + 2 + 2) {
pac = NULL;
goto parse_fail;
}
pac = os_zalloc(sizeof(*pac));
if (pac == NULL)