From: Jouni Malinen Date: Mon, 16 May 2016 17:06:46 +0000 (+0300) Subject: Check hmac_md5() result in radius_msg_verify_msg_auth() X-Git-Tag: hostap_2_6~481 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=38eee0f599fcc7bc161c0a801698a00d1b5fa54a;p=thirdparty%2Fhostap.git Check hmac_md5() result in radius_msg_verify_msg_auth() This gets rid of a valgrind warning on uninitialized memory read in the hostapd_oom_wpa2_eap_connect test case where memcmp is used after failed hmac_md5() call. Signed-off-by: Jouni Malinen --- diff --git a/src/radius/radius.c b/src/radius/radius.c index 97c8de014..67cb92fac 100644 --- a/src/radius/radius.c +++ b/src/radius/radius.c @@ -818,8 +818,9 @@ int radius_msg_verify_msg_auth(struct radius_msg *msg, const u8 *secret, os_memcpy(msg->hdr->authenticator, req_auth, sizeof(msg->hdr->authenticator)); } - hmac_md5(secret, secret_len, wpabuf_head(msg->buf), - wpabuf_len(msg->buf), auth); + if (hmac_md5(secret, secret_len, wpabuf_head(msg->buf), + wpabuf_len(msg->buf), auth) < 0) + return 1; os_memcpy(attr + 1, orig, MD5_MAC_LEN); if (req_auth) { os_memcpy(msg->hdr->authenticator, orig_authenticator,