HS 2.0: Fix Terms and Conditions Server URL macro replacement

The last character of the STA MAC address got replaced with 0x00 due to
truncation if the @1@ macro was used at the end of the URL. Fix this
case by allocating larger buffer for the URL.

Fixes: d4e39c51f8bb ("HS 2.0: Move Terms and Conditions Server URL generation from AP to AS")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/src/radius/radius_server.c b/src/radius/radius_server.c
index e2801aed87502769a3f82e509dbcab94e5b6d948..d66f766241e168dd7a669be4ead3671b8e0311bf 100644 (file)
--- a/src/radius/radius_server.c
+++ b/src/radius/radius_server.c
@@ -950,7 +950,7 @@ radius_server_encapsulate_eap(struct radius_server_data *data,
                }
 
                url_len = os_strlen(url) + ETH_ALEN * 3 - 1 - 3;
-               url2 = os_malloc(url_len);
+               url2 = os_malloc(url_len + 1);
                if (!url2) {
                        RADIUS_DEBUG("Failed to allocate room for T&C Server URL");
                        os_free(url2);
@@ -958,7 +958,7 @@ radius_server_encapsulate_eap(struct radius_server_data *data,
                        return NULL;
                }
                pos2 = url2;
-               end2 = url2 + url_len;
+               end2 = url2 + url_len + 1;
                os_memcpy(pos2, url, pos - url);
                pos2 += pos - url;
                os_snprintf(pos2, end2 - pos2, MACSTR, MAC2STR(sess->mac_addr));