DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

DPP: Fix a memory leak on error path

Browse source 
The encoded CSR could have been leaked if another memory allocation were
to fail in this function. Use a shared return path to free the allocated
temporary buffers to avoid this.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This commit is contained in:
Jouni Malinen 2022-03-08 00:28:10 +02:00 • committed by Jouni Malinen
parent 1d4cd24d0b
commit fd2eb7a41e
1 changed files with 6 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
src/common/dpp.c
View file

@ -815,7 +815,7 @@ struct wpabuf * dpp_build_conf_req_helper(struct dpp_authentication *auth,
size_t len, name_len; size_t len, name_len;
const char *tech = "infra"; const char *tech = "infra";
const char *dpp_name; const char *dpp_name;
struct wpabuf *buf, *json; struct wpabuf *buf = NULL, *json = NULL;
char *csr = NULL; char *csr = NULL;
#ifdef CONFIG_TESTING_OPTIONS #ifdef CONFIG_TESTING_OPTIONS
@ -840,19 +840,17 @@ struct wpabuf * dpp_build_conf_req_helper(struct dpp_authentication *auth,
csr = base64_encode_no_lf(wpabuf_head(auth->csr), csr = base64_encode_no_lf(wpabuf_head(auth->csr),
wpabuf_len(auth->csr), &csr_len); wpabuf_len(auth->csr), &csr_len);
if (!csr) if (!csr)
return NULL; goto fail;
len += 30 + csr_len; len += 30 + csr_len;
} }
#endif /* CONFIG_DPP2 */ #endif /* CONFIG_DPP2 */
json = wpabuf_alloc(len); json = wpabuf_alloc(len);
if (!json) if (!json)
return NULL; goto fail;
json_start_object(json, NULL); json_start_object(json, NULL);
if (json_add_string_escape(json, "name", dpp_name, name_len) < 0) { if (json_add_string_escape(json, "name", dpp_name, name_len) < 0)
wpabuf_free(json); goto fail;
return NULL;
}
json_value_sep(json); json_value_sep(json);
json_add_string(json, "wi-fi_tech", tech); json_add_string(json, "wi-fi_tech", tech);
json_value_sep(json); json_value_sep(json);
@ -877,6 +875,7 @@ struct wpabuf * dpp_build_conf_req_helper(struct dpp_authentication *auth,
json_end_object(json); json_end_object(json);
buf = dpp_build_conf_req(auth, wpabuf_head(json)); buf = dpp_build_conf_req(auth, wpabuf_head(json));
fail:
wpabuf_free(json); wpabuf_free(json);
os_free(csr); os_free(csr);