From d9ba2da026b2c5ae62f17c2fdfdcc724c2abbbf4 Mon Sep 17 00:00:00 2001 From: Sajia Date: Fri, 31 Jul 2026 12:33:11 +0530 Subject: [PATCH] fix(wifi): Prevent double free in owe failure path --- components/wpa_supplicant/src/rsn_supp/wpa.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/components/wpa_supplicant/src/rsn_supp/wpa.c b/components/wpa_supplicant/src/rsn_supp/wpa.c index f75819b9d64..de26028db6b 100644 --- a/components/wpa_supplicant/src/rsn_supp/wpa.c +++ b/components/wpa_supplicant/src/rsn_supp/wpa.c @@ -3333,6 +3333,7 @@ struct wpabuf *owe_build_assoc_req(struct wpa_sm *sm, u16 group) fail: wpabuf_free(pub); crypto_ecdh_deinit(sm->owe_ecdh); + sm->owe_ecdh = NULL; return NULL; } @@ -3446,6 +3447,7 @@ int owe_process_assoc_resp(const u8 *rsn_ie, size_t rsn_len, const uint8_t *dh_i wpabuf_put_buf(hkey, pub); /* C */ wpabuf_free(pub); + pub = NULL; wpabuf_put_data(hkey, dh_ie + 2, dh_len - 2); /* A */ wpabuf_put_le16(hkey, sm->owe_group); /* group */ @@ -3458,7 +3460,9 @@ int owe_process_assoc_resp(const u8 *rsn_ie, size_t rsn_len, const uint8_t *dh_i hash_len = SHA256_MAC_LEN; wpabuf_free(hkey); + hkey = NULL; wpabuf_clear_free(sh_secret); + sh_secret = NULL; wpa_hexdump_key(MSG_DEBUG, "OWE: prk", prk, hash_len);