fix(wifi): Prevent double free in owe failure path

This commit is contained in:
Sajia
2026-07-31 12:33:11 +05:30
parent 4090eeeea4
commit d9ba2da026

View File

@@ -3333,6 +3333,7 @@ struct wpabuf *owe_build_assoc_req(struct wpa_sm *sm, u16 group)
fail:
wpabuf_free(pub);
crypto_ecdh_deinit(sm->owe_ecdh);
sm->owe_ecdh = NULL;
return NULL;
}
@@ -3446,6 +3447,7 @@ int owe_process_assoc_resp(const u8 *rsn_ie, size_t rsn_len, const uint8_t *dh_i
wpabuf_put_buf(hkey, pub); /* C */
wpabuf_free(pub);
pub = NULL;
wpabuf_put_data(hkey, dh_ie + 2, dh_len - 2); /* A */
wpabuf_put_le16(hkey, sm->owe_group); /* group */
@@ -3458,7 +3460,9 @@ int owe_process_assoc_resp(const u8 *rsn_ie, size_t rsn_len, const uint8_t *dh_i
hash_len = SHA256_MAC_LEN;
wpabuf_free(hkey);
hkey = NULL;
wpabuf_clear_free(sh_secret);
sh_secret = NULL;
wpa_hexdump_key(MSG_DEBUG, "OWE: prk", prk, hash_len);