DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

DPP: Avoid a potential use-after-free on an error path in AP

Browse source 
The TX status handler for DPP Authentication Confirm message might have
resulted in use-after-free if the start of a GAS query were to fail,
e.g., due to being somehow unable to transmit the initial request. Avoid
this by explicitly confirming that the authentication session was not
removed.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This commit is contained in:
Jouni Malinen 2024-01-22 13:59:03 +02:00 • committed by Jouni Malinen
parent 32940c7a44
commit 1c90c8d24e
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/ap/dpp_hostapd.c
View file

@ -539,8 +539,15 @@ void hostapd_dpp_tx_status(struct hostapd_data *hapd, const u8 *dst,
return;
}
if (hapd->dpp_auth_ok_on_ack)
if (hapd->dpp_auth_ok_on_ack) {
hostapd_dpp_auth_success(hapd, 1);
if (!hapd->dpp_auth) {
/* The authentication session could have been removed in
* some error cases, e.g., when starting GAS client and
* failing to send the initial request. */
return;
}
}
if (!is_broadcast_ether_addr(dst) && !ok) {
wpa_printf(MSG_DEBUG,