mirror of
https://git.kernel.org/pub/scm/network/wireless/iwd.git
synced 2024-12-22 21:22:37 +01:00
eap: Fix EAP-Success handling
EAP-Success might come in with an identifier that is incremented by 1 from the last Response packet. Since identifier field is a byte, the value might overflow (from 255 -> 0.) This overflow isn't handled properly resulting in EAP-Success/Failure packets with a 0 identifier due to overflow being erroneously ignored. Fix that.
This commit is contained in:
parent
d7136483c3
commit
16739cb4e6
@ -588,8 +588,11 @@ void eap_rx_packet(struct eap_state *eap, const uint8_t *pkt, size_t len)
|
|||||||
* the Success and Failure packets. In order to support
|
* the Success and Failure packets. In order to support
|
||||||
* interoperability with these products we validate id against
|
* interoperability with these products we validate id against
|
||||||
* eap->last_id and its incremented value.
|
* eap->last_id and its incremented value.
|
||||||
|
*
|
||||||
|
* Note: Since last_id is stored as an int and id value is a
|
||||||
|
* byte, we need to support overflow properly.
|
||||||
*/
|
*/
|
||||||
if (id != eap->last_id && id != eap->last_id + 1)
|
if (id != eap->last_id && id != (eap->last_id + 1) % 256)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
if (eap_len != 4)
|
if (eap_len != 4)
|
||||||
|
Loading…
Reference in New Issue
Block a user