mirror of
https://git.kernel.org/pub/scm/network/wireless/iwd.git
synced 2025-01-03 10:32:33 +01:00
sae: fix length check and commit buffer size
A length check was still assuming the 256 bit ECC group. This was updated to scale with the group. The commit buffer was also not properly sized. This was changed to allow for the largest ECC group supported.
This commit is contained in:
parent
2e5099a716
commit
bc9e70f9cd
@ -435,7 +435,8 @@ static void sae_process_commit(struct sae_sm *sm, const uint8_t *from,
|
||||
goto reject;
|
||||
}
|
||||
|
||||
if (len < 98) {
|
||||
/* Scalar + Point + group */
|
||||
if (len < nbytes + nbytes * 2 + 2) {
|
||||
l_error("bad packet length");
|
||||
goto reject;
|
||||
}
|
||||
@ -588,8 +589,8 @@ reject:
|
||||
static void sae_send_commit(struct sae_sm *sm, bool retry)
|
||||
{
|
||||
struct handshake_state *hs = sm->handshake;
|
||||
/* regular commit + possible 256 byte token */
|
||||
uint8_t commit[358];
|
||||
/* regular commit + possible 256 byte token + 6 bytes header */
|
||||
uint8_t commit[L_ECC_SCALAR_MAX_BYTES + L_ECC_POINT_MAX_BYTES + 262];
|
||||
size_t len;
|
||||
|
||||
if (!sae_build_commit(sm, hs->spa, hs->aa, commit, &len, retry))
|
||||
|
Loading…
Reference in New Issue
Block a user