From: Peng Xu <pxu@qti.qualcomm.com>
Date: Thu, 7 Sep 2017 18:21:11 +0000 (-0700)
Subject: FILS: Check req_ies for NULL pointer in hostapd_notif_assoc()
X-Git-Tag: hostap_2_7~1097
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3de1566db829a2a33edd0101009ac60b9af98b66;p=thirdparty%2Fhostap.git

FILS: Check req_ies for NULL pointer in hostapd_notif_assoc()

Add checking for NULL req_ies when FILS processing a driver ASSOC event
in hostapd_notif_assoc(). This was already done in number of old code
paths, but the newer FILS path did not handle this. Though, it is
unlikely that this code path would be reachable in practice since this
is all within sta->auth_alg == WLAN_AUTH_FILS_* check.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
---

diff --git a/src/ap/drv_callbacks.c b/src/ap/drv_callbacks.c
index cce625bf0..8841e843a 100644
--- a/src/ap/drv_callbacks.c
+++ b/src/ap/drv_callbacks.c
@@ -451,6 +451,9 @@ skip_wpa_check:
 	    sta->auth_alg == WLAN_AUTH_FILS_PK) {
 		int delay_assoc = 0;
 
+		if (!req_ies)
+			return WLAN_STATUS_UNSPECIFIED_FAILURE;
+
 		if (!wpa_fils_validate_fils_session(sta->wpa_sm, req_ies,
 						    req_ies_len,
 						    sta->fils_session)) {