mesh: Check that SAE state initialization succeeded for PMKID check

mesh_rsn_auth_sae_sta() might fail, so verify that sta->sae got
allocated before dereferencing it for a PMKID check.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/mesh_rsn.c b/wpa_supplicant/mesh_rsn.c
index 174011b5765c035be4172594311b17bd8d93db9a..4b8d6c46917315b277dcc5562a6645a39a55aa28 100644 (file)
--- a/wpa_supplicant/mesh_rsn.c
+++ b/wpa_supplicant/mesh_rsn.c
@@ -657,7 +657,9 @@ int mesh_rsn_process_ampe(struct wpa_supplicant *wpa_s, struct sta_info *sta,
                mesh_rsn_auth_sae_sta(wpa_s, sta);
        }
 
-       if (chosen_pmk && os_memcmp(chosen_pmk, sta->sae->pmkid, PMKID_LEN)) {
+       if (chosen_pmk &&
+           (!sta->sae ||
+            os_memcmp(chosen_pmk, sta->sae->pmkid, PMKID_LEN) != 0)) {
                wpa_msg(wpa_s, MSG_DEBUG,
                        "Mesh RSN: Invalid PMKID (Chosen PMK did not match calculated PMKID)");
                return -1;