FT: Fix RRB error path handling

When building an RRB message, a failure in wpa_ft_rrb_lin() calls could
have resulted in trying to free an uninitialized pointer. Fix this by
initializing *packet to NULL before going through the initial steps.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/ap/wpa_auth_ft.c b/src/ap/wpa_auth_ft.c
index 2fa85bbd8d28d1312edbf184bffcb312b8a6b367..fab958199b549beff9308bf3ae72f972a0056262 100644 (file)
--- a/src/ap/wpa_auth_ft.c
+++ b/src/ap/wpa_auth_ft.c
@@ -505,6 +505,7 @@ static int wpa_ft_rrb_build(const u8 *key, const size_t key_len,
        size_t plain_len = 0, auth_len = 0;
        int ret = -1;
 
+       *packet = NULL;
        if (wpa_ft_rrb_lin(tlvs_enc0, tlvs_enc1, vlan, &plain, &plain_len) < 0)
                goto out;