aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJouni Malinen <jouni@codeaurora.org>2019-05-08 16:02:19 (GMT)
committerJouni Malinen <j@w1.fi>2019-05-08 16:02:19 (GMT)
commit51dc146f3e0f49e1e0f91339e92e901ff652a30f (patch)
tree4db6e8b41d2666ce74ecdaaad641d1a6ebeea18b
parent677e120181d361a2b52e1f04e1fa5084d9a21873 (diff)
downloadhostap-51dc146f3e0f49e1e0f91339e92e901ff652a30f.zip
hostap-51dc146f3e0f49e1e0f91339e92e901ff652a30f.tar.gz
hostap-51dc146f3e0f49e1e0f91339e92e901ff652a30f.tar.bz2
EAP-PAX server: Avoid debug prints of uninitialized memory in error cases
Use a separate error case handler for eap_pax_mac() failures and memcmp to avoid wpa_hexdump() calls for the (mainly theoretical) local error cases in deriving the MAC. Fixes: b3c2b5d9f7d8 ("EAP-PAX server: Check hash function results") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
-rw-r--r--src/eap_server/eap_server_pax.c26
1 files changed, 20 insertions, 6 deletions
diff --git a/src/eap_server/eap_server_pax.c b/src/eap_server/eap_server_pax.c
index 2e8c1a6..5ed29ef 100644
--- a/src/eap_server/eap_server_pax.c
+++ b/src/eap_server/eap_server_pax.c
@@ -282,8 +282,13 @@ static Boolean eap_pax_check(struct eap_sm *sm, void *priv,
if (eap_pax_mac(data->mac_id, data->ick, EAP_PAX_ICK_LEN,
wpabuf_mhead(respData),
wpabuf_len(respData) - EAP_PAX_ICV_LEN,
- NULL, 0, NULL, 0, icvbuf) < 0 ||
- os_memcmp_const(icvbuf, icv, EAP_PAX_ICV_LEN) != 0) {
+ NULL, 0, NULL, 0, icvbuf) < 0) {
+ wpa_printf(MSG_INFO,
+ "EAP-PAX: Failed to calculate ICV");
+ return TRUE;
+ }
+
+ if (os_memcmp_const(icvbuf, icv, EAP_PAX_ICV_LEN) != 0) {
wpa_printf(MSG_INFO, "EAP-PAX: Invalid ICV");
wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Expected ICV",
icvbuf, EAP_PAX_ICV_LEN);
@@ -413,8 +418,13 @@ static void eap_pax_process_std_2(struct eap_sm *sm,
if (eap_pax_mac(data->mac_id, data->ck, EAP_PAX_CK_LEN,
data->rand.r.x, EAP_PAX_RAND_LEN,
data->rand.r.y, EAP_PAX_RAND_LEN,
- (u8 *) data->cid, data->cid_len, mac) < 0 ||
- os_memcmp_const(mac, pos, EAP_PAX_MAC_LEN) != 0) {
+ (u8 *) data->cid, data->cid_len, mac) < 0) {
+ wpa_printf(MSG_INFO, "EAP-PAX: Failed to calculate MAC_CK");
+ data->state = FAILURE;
+ return;
+ }
+
+ if (os_memcmp_const(mac, pos, EAP_PAX_MAC_LEN) != 0) {
wpa_printf(MSG_INFO, "EAP-PAX: Invalid MAC_CK(A, B, CID) in "
"PAX_STD-2");
wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Expected MAC_CK(A, B, CID)",
@@ -435,8 +445,12 @@ static void eap_pax_process_std_2(struct eap_sm *sm,
if (eap_pax_mac(data->mac_id, data->ick, EAP_PAX_ICK_LEN,
wpabuf_head(respData),
wpabuf_len(respData) - EAP_PAX_ICV_LEN, NULL, 0,
- NULL, 0, icvbuf) < 0 ||
- os_memcmp_const(icvbuf, pos, EAP_PAX_ICV_LEN) != 0) {
+ NULL, 0, icvbuf) < 0) {
+ wpa_printf(MSG_INFO, "EAP-PAX: Failed to calculate ICV");
+ return;
+ }
+
+ if (os_memcmp_const(icvbuf, pos, EAP_PAX_ICV_LEN) != 0) {
wpa_printf(MSG_INFO, "EAP-PAX: Invalid ICV in PAX_STD-2");
wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Expected ICV",
icvbuf, EAP_PAX_ICV_LEN);