From: Alexander Bainbridge-Sedivy <alex.bainbridge@inkbridge.io>
Date: Fri, 12 Jun 2026 19:00:34 +0000 (-0400)
Subject: eap_aka_sim/encode: clear eap_packet->type.data on error paths to avoid dangling... 
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bc44ded7b2bb398dcd20b7fe4caf6215831af7fb;p=thirdparty%2Ffreeradius-server.git

eap_aka_sim/encode: clear eap_packet->type.data on error paths to avoid dangling pointer / double-free
---

diff --git a/src/lib/eap_aka_sim/encode.c b/src/lib/eap_aka_sim/encode.c
index 4847fd42648..eabaafb6a62 100644
--- a/src/lib/eap_aka_sim/encode.c
+++ b/src/lib/eap_aka_sim/encode.c
@@ -952,6 +952,8 @@ ssize_t fr_aka_sim_encode(request_t *request, fr_pair_list_t *to_encode, void *e
 		if (slen < 0) {
 		error:
 			talloc_free(fr_dbuff_buff(&dbuff));
+			eap_packet->type.data = NULL;
+			eap_packet->type.length = 0;
 			return PAIR_ENCODE_FATAL_ERROR;
 		}
 		fr_assert(fr_dbuff_used(&dbuff) > 0);	/* We messed up a check somewhere in the encoder */