aboutsummaryrefslogtreecommitdiffstats
path: root/src/eap_peer/eap_fast_pac.c
diff options
context:
space:
mode:
authorJouni Malinen <jouni@qca.qualcomm.com>2016-02-05 22:26:31 (GMT)
committerJouni Malinen <j@w1.fi>2016-02-05 22:26:31 (GMT)
commite265838a434d9d759776a7657ed665ddc1e83a54 (patch)
treeedb2cb2d11a73b57b08c68f7bd799f740e08ee16 /src/eap_peer/eap_fast_pac.c
parentf91e11f465caf14126a3528dc2edceed963c2993 (diff)
downloadhostap-e265838a434d9d759776a7657ed665ddc1e83a54.zip
hostap-e265838a434d9d759776a7657ed665ddc1e83a54.tar.gz
hostap-e265838a434d9d759776a7657ed665ddc1e83a54.tar.bz2
EAP-FAST: Fix an error path in PAC binary format parsing
Need to clear the pac pointer for the first error case to avoid freeing the previous PAC entry if the following entry has an invalid header. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Diffstat (limited to 'src/eap_peer/eap_fast_pac.c')
-rw-r--r--src/eap_peer/eap_fast_pac.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/src/eap_peer/eap_fast_pac.c b/src/eap_peer/eap_fast_pac.c
index 0220cae..c815860 100644
--- a/src/eap_peer/eap_fast_pac.c
+++ b/src/eap_peer/eap_fast_pac.c
@@ -802,8 +802,10 @@ int eap_fast_load_pac_bin(struct eap_sm *sm, struct eap_fast_pac **pac_root,
while (pos < end) {
u16 val;
- if (end - pos < 2 + EAP_FAST_PAC_KEY_LEN + 2 + 2)
+ if (end - pos < 2 + EAP_FAST_PAC_KEY_LEN + 2 + 2) {
+ pac = NULL;
goto parse_fail;
+ }
pac = os_zalloc(sizeof(*pac));
if (pac == NULL)