DPP: Fix GAS client error case handling

The GAS client processing of the response callback for DPP did not
properly check for GAS query success. This could result in trying to
check the Advertisement Protocol information in failure cases where that
information is not available and that would have resulted in
dereferencing a NULL pointer. Fix this by checking the GAS query result
before processing with processing of the response.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/dpp_supplicant.c b/wpa_supplicant/dpp_supplicant.c
index 899c4c224a85141087e6d879be51fc09ed72eb02..f8e2c831d40a132688a94d93be6a4cf4a267c6c7 100644 (file)
--- a/wpa_supplicant/dpp_supplicant.c
+++ b/wpa_supplicant/dpp_supplicant.c
@@ -1346,7 +1346,8 @@ static void wpas_dpp_gas_resp_cb(void *ctx, const u8 *addr, u8 dialog_token,
                wpa_printf(MSG_DEBUG, "DPP: No matching exchange in progress");
                return;
        }
-       if (!resp || status_code != WLAN_STATUS_SUCCESS) {
+       if (result != GAS_QUERY_SUCCESS ||
+           !resp || status_code != WLAN_STATUS_SUCCESS) {
                wpa_printf(MSG_DEBUG, "DPP: GAS query did not succeed");
                goto fail;
        }