From 35743fa32a8d76a9ea3e1c3b73bca7a0701d37b4 Mon Sep 17 00:00:00 2001 From: Marcel Holtmann Date: Tue, 30 Apr 2019 17:11:39 +0200 Subject: [PATCH] eap: Use l_malloc to avoid variable-length array bound is unknown error --- src/eap-tls-common.c | 3 ++- src/eap-wsc.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/eap-tls-common.c b/src/eap-tls-common.c index 11394d59..be18b5d0 100644 --- a/src/eap-tls-common.c +++ b/src/eap-tls-common.c @@ -320,12 +320,13 @@ static void eap_tls_send_response(struct eap_state *eap, size_t msg_len = EAP_TLS_HEADER_LEN + pdu_len; if (msg_len <= eap_get_mtu(eap)) { - uint8_t buf[msg_len]; + uint8_t *buf = l_malloc(msg_len); buf[EAP_TLS_HEADER_OCTET_FLAGS] = eap_tls->version_negotiated; memcpy(buf + EAP_TLS_HEADER_LEN, pdu, pdu_len); eap_send_response(eap, eap_get_method_type(eap), buf, msg_len); + l_free(buf); return; } diff --git a/src/eap-wsc.c b/src/eap-wsc.c index 9e3b008a..8f463225 100644 --- a/src/eap-wsc.c +++ b/src/eap-wsc.c @@ -353,13 +353,14 @@ static void eap_wsc_send_response(struct eap_state *eap, eap_wsc_state_set_sent_pdu(wsc, pdu, pdu_len); if (msg_len <= eap_get_mtu(eap)) { - uint8_t buf[msg_len]; + uint8_t *buf = l_malloc(msg_len); buf[12] = WSC_OP_MSG; buf[13] = 0; memcpy(buf + EAP_WSC_HEADER_LEN, pdu, pdu_len); eap_send_response(eap, EAP_TYPE_EXPANDED, buf, msg_len); + l_free(buf); return; }