aboutsummaryrefslogtreecommitdiffstats
path: root/wpa_supplicant/hs20_supplicant.c
diff options
context:
space:
mode:
authorJouni Malinen <j@w1.fi>2016-07-04 16:34:22 (GMT)
committerJouni Malinen <j@w1.fi>2016-07-04 16:35:18 (GMT)
commit75b2a879524a34357f4705f5f7408c8974fe0ad5 (patch)
treea09b238584f3bb76a9efefe91a9a24c6110b248f /wpa_supplicant/hs20_supplicant.c
parent8e590f02bd3a82701a9c084c2d60b76226ff747c (diff)
downloadhostap-75b2a879524a34357f4705f5f7408c8974fe0ad5.zip
hostap-75b2a879524a34357f4705f5f7408c8974fe0ad5.tar.gz
hostap-75b2a879524a34357f4705f5f7408c8974fe0ad5.tar.bz2
HS 2.0: Fix hs20_get_icon() error path
If base64_encode() fails (e.g., due to memory allocation failure), the return value needs to be checked against NULL before using the (not really) returned length value. The error path here ended up reading uninitialized variable. Signed-off-by: Jouni Malinen <j@w1.fi>
Diffstat (limited to 'wpa_supplicant/hs20_supplicant.c')
-rw-r--r--wpa_supplicant/hs20_supplicant.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/wpa_supplicant/hs20_supplicant.c b/wpa_supplicant/hs20_supplicant.c
index a62c1c3..1d15677 100644
--- a/wpa_supplicant/hs20_supplicant.c
+++ b/wpa_supplicant/hs20_supplicant.c
@@ -320,7 +320,7 @@ int hs20_get_icon(struct wpa_supplicant *wpa_s, const u8 *bssid,
return -1;
b64 = base64_encode(&icon->image[offset], size, &b64_size);
- if (buf_len >= b64_size) {
+ if (b64 && buf_len >= b64_size) {
os_memcpy(reply, b64, b64_size);
reply_size = b64_size;
} else {