eap_tls_data was already checked.

CID #1339404

diff --git a/src/modules/rlm_eap/lib/base/eap_tls.c b/src/modules/rlm_eap/lib/base/eap_tls.c
index 2df39aad679eb3ef7779ec3a33309ab6ac7276ca..9ef0f7003a656c301c1ae35a3a388ffd56098757 100644 (file)
--- a/src/modules/rlm_eap/lib/base/eap_tls.c
+++ b/src/modules/rlm_eap/lib/base/eap_tls.c
@@ -569,6 +569,10 @@ static eap_tls_status_t eap_tls_verify(eap_session_t *eap_session)
         *      is too short.  See eap_validate()., in ../../eap.c
         */
        eap_tls_data = (eap_tls_data_t *)this_round->response->type.data;
+       if (eap_tls_data) {
+               RDEBUG("Invalid EAP-TLS packet; no data");
+               return EAP_TLS_INVALID;
+       }
 
        /*
         *      First output the flags (for debugging)
@@ -602,9 +606,8 @@ static eap_tls_status_t eap_tls_verify(eap_session_t *eap_session)
         *
         *      Find if this is a reply to the previous request sent
         */
-       if ((!eap_tls_data) ||
-           ((this_round->response->length == EAP_HEADER_LEN + 2) &&
-            ((eap_tls_data->flags & 0xc0) == 0x00))) {
+       if ((this_round->response->length == EAP_HEADER_LEN + 2) &&
+           ((eap_tls_data->flags & 0xc0) == 0x00)) {
                if (!prev_round || (prev_round->request->id != this_round->response->id)) {
                        REDEBUG("Received Invalid TLS ACK");
                        return EAP_TLS_INVALID;