alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2025-08-21 16:55:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

wpa_supplicant: Fix invalid memory dereference

Browse Source
This commit is contained in:
Kapil Gupta
2022-01-18 12:49:25 +05:30
committed by bot
parent 9bc2dd0b53
commit 9b38b15180
3 changed files with 66 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
components/wpa_supplicant/esp_supplicant/src/esp_wpa2.c
View File

@@ -413,7 +413,8 @@ int eap_sm_process_request(struct eap_sm *sm, struct wpabuf *reqData)
return ESP_FAIL;
}
if (ehdr->identifier == sm->current_identifier) {
if (ehdr->identifier == sm->current_identifier &&
sm->lastRespData != NULL) {
/*Retransmit*/
resp = sm->lastRespData;
goto send_resp;
@@ -494,7 +495,10 @@ build_nak:
send_resp:
if (resp == NULL) {
wpa_printf(MSG_ERROR, "Response build fail, return.");
return ESP_FAIL;
wpabuf_free(sm->lastRespData);
sm->lastRespData = resp;
wpa2_set_eap_state(WPA2_ENT_EAP_STATE_FAIL);
return WPA2_ENT_EAP_STATE_FAIL;
}
ret = eap_sm_send_eapol(sm, resp);
if (resp != sm->lastRespData) {