From eb3345b51b812b77e96f922835eb796c10f6a9c7 Mon Sep 17 00:00:00 2001
From: James Prestwood <prestwoj@gmail.com>
Date: Fri, 1 Mar 2024 11:40:54 -0800
Subject: [PATCH] eap-mschapv2: Check Password-Hash exists when loading
 settings

Caught by static analysis, the Password-Hash was never validated so
it could end up memcpying from a NULL pointer.
---
 src/eap-mschapv2.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/eap-mschapv2.c b/src/eap-mschapv2.c
index b75b728a..1639f578 100644
--- a/src/eap-mschapv2.c
+++ b/src/eap-mschapv2.c
@@ -531,6 +531,9 @@ static bool eap_mschapv2_load_settings(struct eap_state *eap,
 		snprintf(setting, sizeof(setting), "%sPassword-Hash", prefix);
 		hash = l_settings_get_bytes(settings, "Security", setting,
 						&hash_len);
+		if (!hash)
+			goto error;
+
 		memcpy(state->password_hash, hash, 16);
 		explicit_bzero(hash, 16);
 		l_free(hash);