From 884036b072faceab7b7d27343f5d4a9bcc862be5 Mon Sep 17 00:00:00 2001 From: Sajia Date: Fri, 31 Jul 2026 12:33:11 +0530 Subject: [PATCH] fix(wifi): Prevent double free in owe failure path --- components/wpa_supplicant/src/rsn_supp/wpa.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/components/wpa_supplicant/src/rsn_supp/wpa.c b/components/wpa_supplicant/src/rsn_supp/wpa.c index d7a23819031..564a7c965cd 100644 --- a/components/wpa_supplicant/src/rsn_supp/wpa.c +++ b/components/wpa_supplicant/src/rsn_supp/wpa.c @@ -2865,6 +2865,7 @@ struct wpabuf *owe_build_assoc_req(struct wpa_sm *sm, u16 group) fail: wpabuf_free(pub); crypto_ecdh_deinit(sm->owe_ecdh); + sm->owe_ecdh = NULL; return NULL; } @@ -2978,6 +2979,7 @@ int owe_process_assoc_resp(const u8 *rsn_ie, size_t rsn_len, const uint8_t *dh_i wpabuf_put_buf(hkey, pub); /* C */ wpabuf_free(pub); + pub = NULL; wpabuf_put_data(hkey, dh_ie + 2, dh_len - 2); /* A */ wpabuf_put_le16(hkey, sm->owe_group); /* group */ @@ -2990,7 +2992,9 @@ int owe_process_assoc_resp(const u8 *rsn_ie, size_t rsn_len, const uint8_t *dh_i hash_len = SHA256_MAC_LEN; wpabuf_free(hkey); + hkey = NULL; wpabuf_clear_free(sh_secret); + sh_secret = NULL; wpa_hexdump_key(MSG_DEBUG, "OWE: prk", prk, hash_len);