aboutsummaryrefslogtreecommitdiffstats
path: root/src/ap/wpa_auth_ft.c
diff options
context:
space:
mode:
authorJouni Malinen <j@w1.fi>2013-04-27 20:05:15 (GMT)
committerJouni Malinen <j@w1.fi>2013-04-27 20:05:15 (GMT)
commit2c48211c495dc04023a16d9d64572448317bcd9a (patch)
tree3cdafadd0be2f6d31740ba84e8ebf8d348daa9ff /src/ap/wpa_auth_ft.c
parent7ca902b53ed69d2dc047c83fc1e396de2f6e9429 (diff)
downloadhostap-2c48211c495dc04023a16d9d64572448317bcd9a.zip
hostap-2c48211c495dc04023a16d9d64572448317bcd9a.tar.gz
hostap-2c48211c495dc04023a16d9d64572448317bcd9a.tar.bz2
FT RRB: Validate os_malloc() return value before using it
Signed-hostap: Jouni Malinen <j@w1.fi>
Diffstat (limited to 'src/ap/wpa_auth_ft.c')
-rw-r--r--src/ap/wpa_auth_ft.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/src/ap/wpa_auth_ft.c b/src/ap/wpa_auth_ft.c
index ccb3f82..791b48d 100644
--- a/src/ap/wpa_auth_ft.c
+++ b/src/ap/wpa_auth_ft.c
@@ -1166,6 +1166,8 @@ int wpa_ft_action_rx(struct wpa_state_machine *sm, const u8 *data, size_t len)
/* RRB - Forward action frame to the target AP */
frame = os_malloc(sizeof(*frame) + len);
+ if (frame == NULL)
+ return -1;
frame->frame_type = RSN_REMOTE_FRAME_TYPE_FT_RRB;
frame->packet_type = FT_PACKET_REQUEST;
frame->action_length = host_to_le16(len);
@@ -1216,6 +1218,8 @@ static int wpa_ft_rrb_rx_request(struct wpa_authenticator *wpa_auth,
rlen = 2 + 2 * ETH_ALEN + 2 + resp_ies_len;
frame = os_malloc(sizeof(*frame) + rlen);
+ if (frame == NULL)
+ return -1;
frame->frame_type = RSN_REMOTE_FRAME_TYPE_FT_RRB;
frame->packet_type = FT_PACKET_RESPONSE;
frame->action_length = host_to_le16(rlen);