DPP: Fix GAS client error case handling in hostapd

The GAS client processing of the response callback for DPP did not
properly check for GAS query success. This could result in trying to
check the Advertisement Protocol information in failure cases where that
information is not available and that would have resulted in
dereferencing a NULL pointer. Fix this by checking the GAS query result
before processing with processing of the response.

This is similar to the earlier wpa_supplicant fix in commit 931f7ff65609
("DPP: Fix GAS client error case handling").

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/ap/dpp_hostapd.c b/src/ap/dpp_hostapd.c
index 6e44bdadfe56cbd71ed813e41d81692ae11f1619..aaeb94c2f53b8fb60a61e3caeeca7179bd9d401b 100644 (file)
--- a/src/ap/dpp_hostapd.c
+++ b/src/ap/dpp_hostapd.c
@@ -915,7 +915,8 @@ static void hostapd_dpp_gas_resp_cb(void *ctx, const u8 *addr, u8 dialog_token,
                wpa_printf(MSG_DEBUG, "DPP: No matching exchange in progress");
                return;
        }
-       if (!resp || status_code != WLAN_STATUS_SUCCESS) {
+       if (result != GAS_QUERY_AP_SUCCESS ||
+           !resp || status_code != WLAN_STATUS_SUCCESS) {
                wpa_printf(MSG_DEBUG, "DPP: GAS query did not succeed");
                goto fail;
        }