Kernel
/
iwd
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git
3
0
Fork 0
Code Releases Activity

eap: Use l_malloc to avoid variable-length array bound is unknown error

This commit is contained in:
Marcel Holtmann 2019-04-30 17:11:39 +02:00
parent 1ca82f4e49
commit 35743fa32a
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/eap-tls-common.c
View File

@ -320,12 +320,13 @@ static void eap_tls_send_response(struct eap_state *eap,
size_t msg_len = EAP_TLS_HEADER_LEN + pdu_len; size_t msg_len = EAP_TLS_HEADER_LEN + pdu_len;
if (msg_len <= eap_get_mtu(eap)) { if (msg_len <= eap_get_mtu(eap)) {
uint8_t buf[msg_len]; uint8_t *buf = l_malloc(msg_len);
buf[EAP_TLS_HEADER_OCTET_FLAGS] = eap_tls->version_negotiated; buf[EAP_TLS_HEADER_OCTET_FLAGS] = eap_tls->version_negotiated;
memcpy(buf + EAP_TLS_HEADER_LEN, pdu, pdu_len); memcpy(buf + EAP_TLS_HEADER_LEN, pdu, pdu_len);
eap_send_response(eap, eap_get_method_type(eap), buf, msg_len); eap_send_response(eap, eap_get_method_type(eap), buf, msg_len);
l_free(buf);
return; return;
} }

3
src/eap-wsc.c
View File

@ -353,13 +353,14 @@ static void eap_wsc_send_response(struct eap_state *eap,
eap_wsc_state_set_sent_pdu(wsc, pdu, pdu_len); eap_wsc_state_set_sent_pdu(wsc, pdu, pdu_len);
if (msg_len <= eap_get_mtu(eap)) { if (msg_len <= eap_get_mtu(eap)) {
uint8_t buf[msg_len]; uint8_t *buf = l_malloc(msg_len);
buf[12] = WSC_OP_MSG; buf[12] = WSC_OP_MSG;
buf[13] = 0; buf[13] = 0;
memcpy(buf + EAP_WSC_HEADER_LEN, pdu, pdu_len); memcpy(buf + EAP_WSC_HEADER_LEN, pdu, pdu_len);
eap_send_response(eap, EAP_TYPE_EXPANDED, buf, msg_len); eap_send_response(eap, EAP_TYPE_EXPANDED, buf, msg_len);
l_free(buf);
return; return;
} }