DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Fix memory leak on NFC DH generation error path

Browse source 
It was possible for some NFC DH generation error paths to leak memory
since the old private/public key was not freed if an allocation failed.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2015-11-29 20:53:20 +02:00
parent c5ef7bbfa5
commit 4104267e81
2 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
src/crypto/dh_group5.c
View file

@ -15,6 +15,7 @@
void * dh5_init(struct wpabuf **priv, struct wpabuf **publ) void * dh5_init(struct wpabuf **priv, struct wpabuf **publ)
{ {
wpabuf_free(*publ);
*publ = dh_init(dh_groups_get(5), priv); *publ = dh_init(dh_groups_get(5), priv);
if (*publ == NULL) if (*publ == NULL)
return NULL; return NULL;

7
src/crypto/dh_groups.c
View file

@ -1218,14 +1218,19 @@ struct wpabuf * dh_init(const struct dh_group *dh, struct wpabuf **priv)
pv_len = dh->prime_len; pv_len = dh->prime_len;
pv = wpabuf_alloc(pv_len); pv = wpabuf_alloc(pv_len);
if (pv == NULL) if (pv == NULL) {
wpabuf_clear_free(*priv);
*priv = NULL;
return NULL; return NULL;
}
if (crypto_mod_exp(dh->generator, dh->generator_len, if (crypto_mod_exp(dh->generator, dh->generator_len,
wpabuf_head(*priv), wpabuf_len(*priv), wpabuf_head(*priv), wpabuf_len(*priv),
dh->prime, dh->prime_len, wpabuf_mhead(pv), dh->prime, dh->prime_len, wpabuf_mhead(pv),
&pv_len) < 0) { &pv_len) < 0) {
wpabuf_clear_free(pv); wpabuf_clear_free(pv);
wpa_printf(MSG_INFO, "DH: crypto_mod_exp failed"); wpa_printf(MSG_INFO, "DH: crypto_mod_exp failed");
wpabuf_clear_free(*priv);
*priv = NULL;
return NULL; return NULL;
} }
wpabuf_put(pv, pv_len); wpabuf_put(pv, pv_len);