From 51dc146f3e0f49e1e0f91339e92e901ff652a30f Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Wed, 8 May 2019 19:02:19 +0300 Subject: [PATCH] EAP-PAX server: Avoid debug prints of uninitialized memory in error cases Use a separate error case handler for eap_pax_mac() failures and memcmp to avoid wpa_hexdump() calls for the (mainly theoretical) local error cases in deriving the MAC. Fixes: b3c2b5d9f7d8 ("EAP-PAX server: Check hash function results") Signed-off-by: Jouni Malinen --- src/eap_server/eap_server_pax.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/src/eap_server/eap_server_pax.c b/src/eap_server/eap_server_pax.c index 2e8c1a60c..5ed29efd1 100644 --- a/src/eap_server/eap_server_pax.c +++ b/src/eap_server/eap_server_pax.c @@ -282,8 +282,13 @@ static Boolean eap_pax_check(struct eap_sm *sm, void *priv, if (eap_pax_mac(data->mac_id, data->ick, EAP_PAX_ICK_LEN, wpabuf_mhead(respData), wpabuf_len(respData) - EAP_PAX_ICV_LEN, - NULL, 0, NULL, 0, icvbuf) < 0 || - os_memcmp_const(icvbuf, icv, EAP_PAX_ICV_LEN) != 0) { + NULL, 0, NULL, 0, icvbuf) < 0) { + wpa_printf(MSG_INFO, + "EAP-PAX: Failed to calculate ICV"); + return TRUE; + } + + if (os_memcmp_const(icvbuf, icv, EAP_PAX_ICV_LEN) != 0) { wpa_printf(MSG_INFO, "EAP-PAX: Invalid ICV"); wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Expected ICV", icvbuf, EAP_PAX_ICV_LEN); @@ -413,8 +418,13 @@ static void eap_pax_process_std_2(struct eap_sm *sm, if (eap_pax_mac(data->mac_id, data->ck, EAP_PAX_CK_LEN, data->rand.r.x, EAP_PAX_RAND_LEN, data->rand.r.y, EAP_PAX_RAND_LEN, - (u8 *) data->cid, data->cid_len, mac) < 0 || - os_memcmp_const(mac, pos, EAP_PAX_MAC_LEN) != 0) { + (u8 *) data->cid, data->cid_len, mac) < 0) { + wpa_printf(MSG_INFO, "EAP-PAX: Failed to calculate MAC_CK"); + data->state = FAILURE; + return; + } + + if (os_memcmp_const(mac, pos, EAP_PAX_MAC_LEN) != 0) { wpa_printf(MSG_INFO, "EAP-PAX: Invalid MAC_CK(A, B, CID) in " "PAX_STD-2"); wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Expected MAC_CK(A, B, CID)", @@ -435,8 +445,12 @@ static void eap_pax_process_std_2(struct eap_sm *sm, if (eap_pax_mac(data->mac_id, data->ick, EAP_PAX_ICK_LEN, wpabuf_head(respData), wpabuf_len(respData) - EAP_PAX_ICV_LEN, NULL, 0, - NULL, 0, icvbuf) < 0 || - os_memcmp_const(icvbuf, pos, EAP_PAX_ICV_LEN) != 0) { + NULL, 0, icvbuf) < 0) { + wpa_printf(MSG_INFO, "EAP-PAX: Failed to calculate ICV"); + return; + } + + if (os_memcmp_const(icvbuf, pos, EAP_PAX_ICV_LEN) != 0) { wpa_printf(MSG_INFO, "EAP-PAX: Invalid ICV in PAX_STD-2"); wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Expected ICV", icvbuf, EAP_PAX_ICV_LEN);