From 5ca1196577d9bbea5eaecaf129c57738b3092d2e Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Tue, 31 Jul 2018 00:07:36 +0300 Subject: [PATCH] HS 2.0: Fix Terms and Conditions Server URL macro replacement The last character of the STA MAC address got replaced with 0x00 due to truncation if the @1@ macro was used at the end of the URL. Fix this case by allocating larger buffer for the URL. Fixes: d4e39c51f8bb ("HS 2.0: Move Terms and Conditions Server URL generation from AP to AS") Signed-off-by: Jouni Malinen --- src/radius/radius_server.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/radius/radius_server.c b/src/radius/radius_server.c index e2801aed8..d66f76624 100644 --- a/src/radius/radius_server.c +++ b/src/radius/radius_server.c @@ -950,7 +950,7 @@ radius_server_encapsulate_eap(struct radius_server_data *data, } url_len = os_strlen(url) + ETH_ALEN * 3 - 1 - 3; - url2 = os_malloc(url_len); + url2 = os_malloc(url_len + 1); if (!url2) { RADIUS_DEBUG("Failed to allocate room for T&C Server URL"); os_free(url2); @@ -958,7 +958,7 @@ radius_server_encapsulate_eap(struct radius_server_data *data, return NULL; } pos2 = url2; - end2 = url2 + url_len; + end2 = url2 + url_len + 1; os_memcpy(pos2, url, pos - url); pos2 += pos - url; os_snprintf(pos2, end2 - pos2, MACSTR, MAC2STR(sess->mac_addr)); -- 2.47.2