OWE: Fix for entry->ssid possibly NULL dereference

Pointer entry->ssid might be passed to owe_trans_ssid_match() function
as argument 3 with NULL value, and it may be dereferenced there. This
looks like a theoretical case that would not be reached in practice, but
anyway, it is better to check entry->ssid != NULL more consistently.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>

diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index f1dc006515fdbe7c957af1bd27b237fd0a12af9f..19f1241748eefbb37827b4d89c2b7e748a275890 100644 (file)
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -5268,8 +5268,9 @@ struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
 
 #ifdef CONFIG_OWE
                if (!wpas_network_disabled(wpa_s, entry) &&
-                   owe_trans_ssid_match(wpa_s, bssid, entry->ssid,
-                   entry->ssid_len) &&
+                   (entry->ssid &&
+                    owe_trans_ssid_match(wpa_s, bssid, entry->ssid,
+                                         entry->ssid_len)) &&
                    (!entry->bssid_set ||
                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
                        return entry;