Clear PSK explicitly from memory in couple more cases on deinit

Couple of the WPS/P2P/RADIUS-PSK cases were freeing heap memory
allocations without explicitly clearing the PSK value. Add such clearing
for these to avoid leaving the PSK in memory after it is not needed
anymore.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>

diff --git a/src/ap/ieee802_11_auth.c b/src/ap/ieee802_11_auth.c
index 783ee6dea96b22357fd532d03584cff99d705e15..cf13008a1df81b5bf82eee79fde80ff38958c736 100644 (file)
--- a/src/ap/ieee802_11_auth.c
+++ b/src/ap/ieee802_11_auth.c
@@ -646,6 +646,6 @@ void hostapd_free_psk_list(struct hostapd_sta_wpa_psk_short *psk)
        while (psk) {
                struct hostapd_sta_wpa_psk_short *prev = psk;
                psk = psk->next;
-               os_free(prev);
+               bin_clear_free(prev, sizeof(*prev));
        }
 }

diff --git a/src/ap/wps_hostapd.c b/src/ap/wps_hostapd.c
index 4f1c76b7b65c45b8e2a226f5923350e09d924b07..aacfa337260a61c3b84c2da04ec65adccfee46e5 100644 (file)
--- a/src/ap/wps_hostapd.c
+++ b/src/ap/wps_hostapd.c
@@ -1069,10 +1069,11 @@ static void hostapd_free_wps(struct wps_context *wps)
        for (i = 0; i < MAX_WPS_VENDOR_EXTENSIONS; i++)
                wpabuf_free(wps->dev.vendor_ext[i]);
        wps_device_data_free(&wps->dev);
-       os_free(wps->network_key);
+       bin_clear_free(wps->network_key, wps->network_key_len);
        hostapd_wps_nfc_clear(wps);
        wpabuf_free(wps->dh_pubkey);
        wpabuf_free(wps->dh_privkey);
+       forced_memzero(wps->psk, sizeof(wps->psk));
        os_free(wps);
 }
 

diff --git a/wpa_supplicant/p2p_supplicant.c b/wpa_supplicant/p2p_supplicant.c
index ce44dfb9e053da44a803a6b722533f748d37dc3a..a996b436b4297ab779edf15d9429500af641e5d8 100644 (file)
--- a/wpa_supplicant/p2p_supplicant.c
+++ b/wpa_supplicant/p2p_supplicant.c
@@ -8825,7 +8825,7 @@ static void wpas_p2p_remove_client_go(struct wpa_supplicant *wpa_s,
                                hapd->conf->ssid.wpa_psk = psk->next;
                        rem = psk;
                        psk = psk->next;
-                       os_free(rem);
+                       bin_clear_free(rem, sizeof(*rem));
                } else {
                        prev = psk;
                        psk = psk->next;