EAP-PAX server: Avoid debug prints of uninitialized memory in error cases

Use a separate error case handler for eap_pax_mac() failures and memcmp
to avoid wpa_hexdump() calls for the (mainly theoretical) local error
cases in deriving the MAC.

Fixes: b3c2b5d9f7d8 ("EAP-PAX server: Check hash function results")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/src/eap_server/eap_server_pax.c b/src/eap_server/eap_server_pax.c
index 2e8c1a60c71fe23f56b0bddaa3074b4ba50bd64e..5ed29efd1d3cbbda07f78baf7475f23a69bf736e 100644 (file)
--- a/src/eap_server/eap_server_pax.c
+++ b/src/eap_server/eap_server_pax.c
@@ -282,8 +282,13 @@ static Boolean eap_pax_check(struct eap_sm *sm, void *priv,
                if (eap_pax_mac(data->mac_id, data->ick, EAP_PAX_ICK_LEN,
                                wpabuf_mhead(respData),
                                wpabuf_len(respData) - EAP_PAX_ICV_LEN,
-                               NULL, 0, NULL, 0, icvbuf) < 0 ||
-                   os_memcmp_const(icvbuf, icv, EAP_PAX_ICV_LEN) != 0) {
+                               NULL, 0, NULL, 0, icvbuf) < 0) {
+                       wpa_printf(MSG_INFO,
+                                  "EAP-PAX: Failed to calculate ICV");
+                       return TRUE;
+               }
+
+               if (os_memcmp_const(icvbuf, icv, EAP_PAX_ICV_LEN) != 0) {
                        wpa_printf(MSG_INFO, "EAP-PAX: Invalid ICV");
                        wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Expected ICV",
                                    icvbuf, EAP_PAX_ICV_LEN);
@@ -413,8 +418,13 @@ static void eap_pax_process_std_2(struct eap_sm *sm,
        if (eap_pax_mac(data->mac_id, data->ck, EAP_PAX_CK_LEN,
                        data->rand.r.x, EAP_PAX_RAND_LEN,
                        data->rand.r.y, EAP_PAX_RAND_LEN,
-                       (u8 *) data->cid, data->cid_len, mac) < 0 ||
-           os_memcmp_const(mac, pos, EAP_PAX_MAC_LEN) != 0) {
+                       (u8 *) data->cid, data->cid_len, mac) < 0) {
+               wpa_printf(MSG_INFO, "EAP-PAX: Failed to calculate MAC_CK");
+               data->state = FAILURE;
+               return;
+       }
+
+       if (os_memcmp_const(mac, pos, EAP_PAX_MAC_LEN) != 0) {
                wpa_printf(MSG_INFO, "EAP-PAX: Invalid MAC_CK(A, B, CID) in "
                           "PAX_STD-2");
                wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Expected MAC_CK(A, B, CID)",
@@ -435,8 +445,12 @@ static void eap_pax_process_std_2(struct eap_sm *sm,
        if (eap_pax_mac(data->mac_id, data->ick, EAP_PAX_ICK_LEN,
                        wpabuf_head(respData),
                        wpabuf_len(respData) - EAP_PAX_ICV_LEN, NULL, 0,
-                       NULL, 0, icvbuf) < 0 ||
-           os_memcmp_const(icvbuf, pos, EAP_PAX_ICV_LEN) != 0) {
+                       NULL, 0, icvbuf) < 0) {
+               wpa_printf(MSG_INFO, "EAP-PAX: Failed to calculate ICV");
+               return;
+       }
+
+       if (os_memcmp_const(icvbuf, pos, EAP_PAX_ICV_LEN) != 0) {
                wpa_printf(MSG_INFO, "EAP-PAX: Invalid ICV in PAX_STD-2");
                wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Expected ICV",
                            icvbuf, EAP_PAX_ICV_LEN);