From 04cad507e1521682a2d138217c3afd0b4ddcada5 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sun, 11 May 2014 17:54:59 +0300 Subject: [PATCH] EAP-SIM peer: Fix counter-too-small message building The extra data (nonce_s) used in this message was pointing to the parsed, decrypted data and that buffer was previously freed just before building the new message. This resulted in use of freed data and possibly incorrect extra data value that caused the authentication attempt to fail. Fix this by reordering the code to free the decrypted data only after the new message has been generated. This was already the case for EAP-AKA/AKA', but somehow missing from EAP-SIM. Signed-off-by: Jouni Malinen --- src/eap_peer/eap_sim.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/eap_peer/eap_sim.c b/src/eap_peer/eap_sim.c index d8560543f..fc9df96ea 100644 --- a/src/eap_peer/eap_sim.c +++ b/src/eap_peer/eap_sim.c @@ -952,9 +952,11 @@ static struct wpabuf * eap_sim_process_reauthentication( } if (eattr.counter < 0 || (size_t) eattr.counter <= data->counter) { + struct wpabuf *res; wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid counter " "(%d <= %d)", eattr.counter, data->counter); data->counter_too_small = eattr.counter; + /* Reply using Re-auth w/ AT_COUNTER_TOO_SMALL. The current * reauth_id must not be used to start a new reauthentication. * However, since it was used in the last EAP-Response-Identity @@ -965,8 +967,11 @@ static struct wpabuf * eap_sim_process_reauthentication( data->last_eap_identity_len = data->reauth_id_len; data->reauth_id = NULL; data->reauth_id_len = 0; + + res = eap_sim_response_reauth(data, id, 1, eattr.nonce_s); os_free(decrypted); - return eap_sim_response_reauth(data, id, 1, eattr.nonce_s); + + return res; } data->counter = eattr.counter;