]> git.ipfire.org Git - thirdparty/freeradius-server.git/commitdiff
eap_aka_sim/xlat: NULL dereference in id_method and id_type xlat handlers if dict...
authorAlexander Bainbridge-Sedivy <alex.bainbridge@inkbridge.io>
Thu, 7 May 2026 18:59:38 +0000 (14:59 -0400)
committerAlan T. DeKok <aland@freeradius.org>
Wed, 27 May 2026 17:38:30 +0000 (13:38 -0400)
src/lib/eap_aka_sim/xlat.c

index c86f46ca0959b91797d8dd67e385d418ccbbd038..faf0fa2fd1a04a35b7f9b833470c65281fd9bcd2 100644 (file)
@@ -83,6 +83,11 @@ static xlat_action_t aka_sim_xlat_id_method_xlat(TALLOC_CTX *ctx, fr_dcursor_t *
                break;
        }
 
+       if (!method) {
+               REDEBUG2("No dictionary value name for method hint");
+               return XLAT_ACTION_FAIL;
+       }
+
        MEM(vb = fr_value_box_alloc(ctx, FR_TYPE_STRING, NULL));
        fr_value_box_bstrndup(vb, vb, NULL, method, strlen(method), false);
        fr_dcursor_append(out, vb);
@@ -139,6 +144,11 @@ static xlat_action_t aka_sim_xlat_id_type_xlat(TALLOC_CTX *ctx, fr_dcursor_t *ou
                break;
        }
 
+       if (!type) {
+               REDEBUG2("No dictionary value name for identity type");
+               return XLAT_ACTION_FAIL;
+       }
+
        MEM(vb = fr_value_box_alloc(ctx, FR_TYPE_STRING, NULL));
        fr_value_box_bstrndup(vb, vb, NULL, type, strlen(type), false);
        fr_dcursor_append(out, vb);