Fix error path on Key Data field decryption

key_data_buf is already freed on the common exit path, so do not try to
free it here on error.

Fixes: 4abc37e67b9a ("Support Key Data field decryption for EAPOL-Key msg 2/4 and 4/4")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>

diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c
index f3fc85af15b6ece24a84fac22f299c6bdce9fdd6..e0c9f30c17db9813366edf92b0680a62c62d5914 100644 (file)
--- a/src/ap/wpa_auth.c
+++ b/src/ap/wpa_auth.c
@@ -1199,7 +1199,6 @@ void wpa_receive(struct wpa_authenticator *wpa_auth,
                key_data_buf_len = key_data_length;
                if (aes_unwrap(sm->PTK.kek, sm->PTK.kek_len,
                               key_data_length / 8, key_data, key_data_buf)) {
-                       bin_clear_free(key_data_buf, key_data_buf_len);
                        wpa_printf(MSG_INFO,
                                   "RSN: AES unwrap failed - could not decrypt EAPOL-Key key data");
                        goto out;