From: Jouni Malinen <j@w1.fi>
Date: Thu, 12 Jun 2014 21:36:42 +0000 (+0300)
Subject: HS 2.0R2: Fix OSEN IE parsing for in cipher setup (CID 68132)
X-Git-Tag: hostap_2_3~313
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=137ff332fd279cbf070e22b8a104606447d0506b;p=thirdparty%2Fhostap.git

HS 2.0R2: Fix OSEN IE parsing for in cipher setup (CID 68132)

The OSEN code path hardcodes number of struct wpa_ie_data items.
However, it did not clear the full structure and some uninitialized
fields could have been used (e.g., ie.mgmt_group_cipher for a debug
print and ie.capabilities for checking MFPC). Fix this by clearing the
ie data before filling in the hardcoded OSEN values.

Signed-off-by: Jouni Malinen <j@w1.fi>
---

diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index ffba0f5e7..c4d5cb251 100644
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -984,6 +984,7 @@ int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
 	} else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
 		wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
 		/* TODO: parse OSEN element */
+		os_memset(&ie, 0, sizeof(ie));
 		ie.group_cipher = WPA_CIPHER_CCMP;
 		ie.pairwise_cipher = WPA_CIPHER_CCMP;
 		ie.key_mgmt = WPA_KEY_MGMT_OSEN;