aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJouni Malinen <j@w1.fi>2018-05-28 13:17:20 (GMT)
committerJouni Malinen <j@w1.fi>2018-05-28 19:09:20 (GMT)
commit7280723fbfa7c609d8545e855a7399e1b3061457 (patch)
tree9e6381ddaaa6bb33b18ed8a219d01c4bfa5f0ca8
parent44136f6ca2d97c2300a1021e0b2f4140035b4c4a (diff)
downloadhostap-7280723fbfa7c609d8545e855a7399e1b3061457.zip
hostap-7280723fbfa7c609d8545e855a7399e1b3061457.tar.gz
hostap-7280723fbfa7c609d8545e855a7399e1b3061457.tar.bz2
EAP-pwd peer: Check for unexpected state for ID exchange
Aborty processing if ID exchange processing is entered twice unexpectedly. This avoids memory leaks in the function. Signed-off-by: Jouni Malinen <j@w1.fi>
-rw-r--r--src/eap_peer/eap_pwd.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c
index e74aef1..748b087 100644
--- a/src/eap_peer/eap_pwd.c
+++ b/src/eap_peer/eap_pwd.c
@@ -255,6 +255,12 @@ eap_pwd_perform_id_exchange(struct eap_sm *sm, struct eap_pwd_data *data,
data->prep = id->prep;
os_memcpy(data->token, id->token, sizeof(id->token));
+ if (data->id_server || data->grp) {
+ wpa_printf(MSG_INFO, "EAP-pwd: data was already allocated");
+ eap_pwd_state(data, FAILURE);
+ return;
+ }
+
data->id_server = os_malloc(payload_len - sizeof(struct eap_pwd_id));
if (data->id_server == NULL) {
wpa_printf(MSG_INFO, "EAP-PWD: memory allocation id fail");