diff options
| author | Jouni Malinen <j@w1.fi> | 2015-05-02 19:26:28 +0300 |
|---|---|---|
| committer | Michael Bestas <mikeioannina@gmail.com> | 2015-11-11 19:40:00 +0200 |
| commit | 4060a8f592372e56f988c12819cffb1c46cee12c (patch) | |
| tree | a4296d2b92514f4ba418a4f3e2ca236ba126f773 | |
| parent | 84b0fb91020630c8b314c9b96d5d78cc9e562de1 (diff) | |
| download | android_external_wpa_supplicant_8-4060a8f592372e56f988c12819cffb1c46cee12c.tar.gz android_external_wpa_supplicant_8-4060a8f592372e56f988c12819cffb1c46cee12c.tar.bz2 android_external_wpa_supplicant_8-4060a8f592372e56f988c12819cffb1c46cee12c.zip | |
EAP-pwd peer: Fix asymmetric fragmentation behavior
The L (Length) and M (More) flags needs to be cleared before deciding
whether the locally generated response requires fragmentation. This
fixes an issue where these flags from the server could have been invalid
for the following message. In some cases, this could have resulted in
triggering the wpabuf security check that would terminate the process
due to invalid buffer allocation.
Change-Id: Id3bb2a36b7b0a040e81ec1f1064934047606259a
Signed-off-by: Jouni Malinen <j@w1.fi>
| -rw-r--r-- | src/eap_peer/eap_pwd.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c index 871bb685..56f1eba2 100644 --- a/src/eap_peer/eap_pwd.c +++ b/src/eap_peer/eap_pwd.c @@ -869,6 +869,7 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret, /* * we have output! Do we need to fragment it? */ + lm_exch = EAP_PWD_GET_EXCHANGE(lm_exch); len = wpabuf_len(data->outbuf); if ((len + EAP_PWD_HDR_SIZE) > data->mtu) { resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, data->mtu, |