EAP-pwd peer: Fix asymmetric fragmentation behavior

The L (Length) and M (More) flags needs to be cleared before deciding
whether the locally generated response requires fragmentation. This
fixes an issue where these flags from the server could have been invalid
for the following message. In some cases, this could have resulted in
triggering the wpabuf security check that would terminate the process
due to invalid buffer allocation.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c
index 1d2079b0276daf8c1a5200eeba0276959771358a..e58b13a42f73deb6ae3f1fbb2077a6c1bfb7c77d 100644 (file)
--- a/src/eap_peer/eap_pwd.c
+++ b/src/eap_peer/eap_pwd.c
@@ -968,6 +968,7 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret,
        /*
         * we have output! Do we need to fragment it?
         */
+       lm_exch = EAP_PWD_GET_EXCHANGE(lm_exch);
        len = wpabuf_len(data->outbuf);
        if ((len + EAP_PWD_HDR_SIZE) > data->mtu) {
                resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, data->mtu,