HS 2.0: Fix hs20_get_icon() error path

If base64_encode() fails (e.g., due to memory allocation failure), the
return value needs to be checked against NULL before using the (not
really) returned length value. The error path here ended up reading
uninitialized variable.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/hs20_supplicant.c b/wpa_supplicant/hs20_supplicant.c
index a62c1c36af44d2298e98052e7d821bd907a7a9f0..1d156776817da186a45601b5032a02bf3f9a7a3c 100644 (file)
--- a/wpa_supplicant/hs20_supplicant.c
+++ b/wpa_supplicant/hs20_supplicant.c
@@ -320,7 +320,7 @@ int hs20_get_icon(struct wpa_supplicant *wpa_s, const u8 *bssid,
                return -1;
 
        b64 = base64_encode(&icon->image[offset], size, &b64_size);
-       if (buf_len >= b64_size) {
+       if (b64 && buf_len >= b64_size) {
                os_memcpy(reply, b64, b64_size);
                reply_size = b64_size;
        } else {