]> git.ipfire.org Git - thirdparty/hostap.git/commit
EAP-pwd peer: Fix error path for unexpected Confirm message
authorJouni Malinen <j@w1.fi>
Sun, 1 Nov 2015 17:35:44 +0000 (19:35 +0200)
committerJouni Malinen <j@w1.fi>
Tue, 10 Nov 2015 16:40:54 +0000 (18:40 +0200)
commit95577884ca4fa76be91344ff7a8d5d1e6dc3da61
treec8bcf69ffd9dfa0b1a517efc6390c8e04f153d11
parentbef802ece03f9ae9d52a21f0cf4f1bc2c5a1f8aa
EAP-pwd peer: Fix error path for unexpected Confirm message

If the Confirm message is received from the server before the Identity
exchange has been completed, the group has not yet been determined and
data->grp is NULL. The error path in eap_pwd_perform_confirm_exchange()
did not take this corner case into account and could end up
dereferencing a NULL pointer and terminating the process if invalid
message sequence is received. (CVE-2015-5316)

Signed-off-by: Jouni Malinen <j@w1.fi>
src/eap_peer/eap_pwd.c