Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fix/owe_prevent_double_free' into 'master'

Browse Source 
fix(wifi): Prevent double free in owe failure path

Closes SEC-261

See merge request espressif/esp-idf!51401
This commit is contained in:
Jiang Jiang Jian
2026-08-10 14:18:26 +08:00
parent a1ca70eb43 d9ba2da026
commit 67b6ef3c1c
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
components/wpa_supplicant/src/rsn_supp/wpa.c
View File

@@ -3333,6 +3333,7 @@ struct wpabuf *owe_build_assoc_req(struct wpa_sm *sm, u16 group)
fail: fail:
wpabuf_free(pub); wpabuf_free(pub);
crypto_ecdh_deinit(sm->owe_ecdh); crypto_ecdh_deinit(sm->owe_ecdh);
sm->owe_ecdh = NULL;
return NULL; return NULL;
} }
@@ -3446,6 +3447,7 @@ int owe_process_assoc_resp(const u8 *rsn_ie, size_t rsn_len, const uint8_t *dh_i
wpabuf_put_buf(hkey, pub); /* C */ wpabuf_put_buf(hkey, pub); /* C */
wpabuf_free(pub); wpabuf_free(pub);
pub = NULL;
wpabuf_put_data(hkey, dh_ie + 2, dh_len - 2); /* A */ wpabuf_put_data(hkey, dh_ie + 2, dh_len - 2); /* A */
wpabuf_put_le16(hkey, sm->owe_group); /* group */ wpabuf_put_le16(hkey, sm->owe_group); /* group */
@@ -3458,7 +3460,9 @@ int owe_process_assoc_resp(const u8 *rsn_ie, size_t rsn_len, const uint8_t *dh_i
hash_len = SHA256_MAC_LEN; hash_len = SHA256_MAC_LEN;
wpabuf_free(hkey); wpabuf_free(hkey);
hkey = NULL;
wpabuf_clear_free(sh_secret); wpabuf_clear_free(sh_secret);
sh_secret = NULL;
wpa_hexdump_key(MSG_DEBUG, "OWE: prk", prk, hash_len); wpa_hexdump_key(MSG_DEBUG, "OWE: prk", prk, hash_len);