Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

SAE: Fix crash due to NULL pointer dereference in H2E parsing

Browse Source 
In H2E (Hash-to-Element) mode, sae_parse_commit() parses the optional
Anti-Clogging Token Container by calling sae_parse_token_container().

However, callers of sae_parse_commit() that do not require retrieving
the anti-clogging token (such as PASN initiator/responder and SME auth)
pass NULL for the token and token_len output arguments.

If the peer sends a Commit frame containing a valid Anti-Clogging
Token Container element, sae_parse_token_container() unconditionally
sets *token and *token_len, resulting in a NULL pointer dereference
(SIGSEGV) and crashing wpa_supplicant.

Fix this by adding NULL checks before writing to token and token_len.
Update the debug log to print the token directly using 'pos'.

Fixes: 5e32fb0170f4 ("SAE: Use Anti-Clogging Token Container element with H2E")
Signed-off-by: Amarnath Hullur Subramanyam <amarnathhs@google.com>
This commit is contained in:
Jimi Chen
2026-05-21 06:56:54 +00:00
committed by BOT
parent 9c825298fc
commit 9de31f008c
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
components/wpa_supplicant/src/common/sae.c
View File

@@ -1828,10 +1828,12 @@ static void sae_parse_token_container(struct sae_data *sae,
pos, end - pos);
if (!sae_is_token_container_elem(pos, end))
return;
*token = pos + 3;
*token_len = pos[1] - 1;
if (token)
*token = pos + 3;
if (token_len)
*token_len = pos[1] - 1;
wpa_hexdump(MSG_DEBUG, "SAE: Anti-Clogging Token (in container)",
*token, *token_len);
pos + 3, pos[1] - 1);
}