aboutsummaryrefslogtreecommitdiffstats
path: root/src/radius
diff options
context:
space:
mode:
authorJouni Malinen <jouni@codeaurora.org>2018-07-30 21:07:36 (GMT)
committerJouni Malinen <j@w1.fi>2018-07-30 21:07:36 (GMT)
commit5ca1196577d9bbea5eaecaf129c57738b3092d2e (patch)
treefef4a20d1c12e0982de494ee13bf8fad9de51e4a /src/radius
parent420b5dd81490f9a7c14af4d639f4a9a10f5ea3ce (diff)
downloadhostap-5ca1196577d9bbea5eaecaf129c57738b3092d2e.zip
hostap-5ca1196577d9bbea5eaecaf129c57738b3092d2e.tar.gz
hostap-5ca1196577d9bbea5eaecaf129c57738b3092d2e.tar.bz2
HS 2.0: Fix Terms and Conditions Server URL macro replacement
The last character of the STA MAC address got replaced with 0x00 due to truncation if the @1@ macro was used at the end of the URL. Fix this case by allocating larger buffer for the URL. Fixes: d4e39c51f8bb ("HS 2.0: Move Terms and Conditions Server URL generation from AP to AS") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Diffstat (limited to 'src/radius')
-rw-r--r--src/radius/radius_server.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/src/radius/radius_server.c b/src/radius/radius_server.c
index e2801ae..d66f766 100644
--- a/src/radius/radius_server.c
+++ b/src/radius/radius_server.c
@@ -950,7 +950,7 @@ radius_server_encapsulate_eap(struct radius_server_data *data,
}
url_len = os_strlen(url) + ETH_ALEN * 3 - 1 - 3;
- url2 = os_malloc(url_len);
+ url2 = os_malloc(url_len + 1);
if (!url2) {
RADIUS_DEBUG("Failed to allocate room for T&C Server URL");
os_free(url2);
@@ -958,7 +958,7 @@ radius_server_encapsulate_eap(struct radius_server_data *data,
return NULL;
}
pos2 = url2;
- end2 = url2 + url_len;
+ end2 = url2 + url_len + 1;
os_memcpy(pos2, url, pos - url);
pos2 += pos - url;
os_snprintf(pos2, end2 - pos2, MACSTR, MAC2STR(sess->mac_addr));