EAP-EKE: Reject too long Prot() data when building a frame

This error case in own buffer lengths being too short was not handled
properly. While this should not really happen since the wpabuf
allocation is made large for the fixed cases that are currently
supported, better make eap_eke_prot() safer if this functionally ever
gets extended with a longer buffer need.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/eap_common/eap_eke_common.c b/src/eap_common/eap_eke_common.c
index 4dfdb3f9c96bdff3cca3f4f60e7852e9c3a3076f..b603e32b314b5872cd87721c7f47f478110f0d2c 100644 (file)
--- a/src/eap_common/eap_eke_common.c
+++ b/src/eap_common/eap_eke_common.c
@@ -635,6 +635,7 @@ int eap_eke_prot(struct eap_eke_session *sess,
 
        if (*prot_len < block_size + data_len + pad + icv_len) {
                wpa_printf(MSG_INFO, "EAP-EKE: Not enough room for Prot() data");
+               return -1;
        }
        pos = prot;