DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

mka: Avoid memory leak in unexpected case in RECEIVE

Browse source 
It looks like it is possible for the RECEIVE state to leak memory where
a previously allocated sm->lki is moved to sm->oki while sm->oki is
pointing to not yet freed entry. It is not clear how this can be
triggered, but it has come up in hwsim testing under heavy load.

Free sm->oki if it is still set in RECEIVE before replacing it with
sm->lki to avoid this memory leak.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit is contained in:
Jouni Malinen 2019-04-15 22:50:06 +03:00 committed by Jouni Malinen
parent 984d5b7e1f
commit 0be8b9238f
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/pae/ieee802_1x_cp.c
View file

@ -214,6 +214,10 @@ SM_STATE(CP, RECEIVE)
SM_ENTRY(CP, RECEIVE); SM_ENTRY(CP, RECEIVE);
/* RECEIVE state machine not keep with Figure 12-2 in /* RECEIVE state machine not keep with Figure 12-2 in
* IEEE Std 802.1X-2010 */ * IEEE Std 802.1X-2010 */
if (sm->oki) {
ieee802_1x_kay_delete_sas(sm->kay, sm->oki);
os_free(sm->oki);
}
sm->oki = sm->lki; sm->oki = sm->lki;
sm->oan = sm->lan; sm->oan = sm->lan;
sm->otx = sm->ltx; sm->otx = sm->ltx;