From 9de31f008ca2fa77187ed9cd3ddec4e7832e1f6b Mon Sep 17 00:00:00 2001 From: Jimi Chen Date: Thu, 21 May 2026 06:56:54 +0000 Subject: [PATCH] SAE: Fix crash due to NULL pointer dereference in H2E parsing In H2E (Hash-to-Element) mode, sae_parse_commit() parses the optional Anti-Clogging Token Container by calling sae_parse_token_container(). However, callers of sae_parse_commit() that do not require retrieving the anti-clogging token (such as PASN initiator/responder and SME auth) pass NULL for the token and token_len output arguments. If the peer sends a Commit frame containing a valid Anti-Clogging Token Container element, sae_parse_token_container() unconditionally sets *token and *token_len, resulting in a NULL pointer dereference (SIGSEGV) and crashing wpa_supplicant. Fix this by adding NULL checks before writing to token and token_len. Update the debug log to print the token directly using 'pos'. Fixes: 5e32fb0170f4 ("SAE: Use Anti-Clogging Token Container element with H2E") Signed-off-by: Amarnath Hullur Subramanyam --- components/wpa_supplicant/src/common/sae.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/components/wpa_supplicant/src/common/sae.c b/components/wpa_supplicant/src/common/sae.c index 192b4f6c769..8e5e941c724 100644 --- a/components/wpa_supplicant/src/common/sae.c +++ b/components/wpa_supplicant/src/common/sae.c @@ -1828,10 +1828,12 @@ static void sae_parse_token_container(struct sae_data *sae, pos, end - pos); if (!sae_is_token_container_elem(pos, end)) return; - *token = pos + 3; - *token_len = pos[1] - 1; + if (token) + *token = pos + 3; + if (token_len) + *token_len = pos[1] - 1; wpa_hexdump(MSG_DEBUG, "SAE: Anti-Clogging Token (in container)", - *token, *token_len); + pos + 3, pos[1] - 1); }