Skip to content

Commit 3ec2a2c

Browse files
author
Mika Leppänen
committed
Corrected freed memory access on incoming EAPOL handling
For repeated/duplicated EAP-TLS messages it is possible that they arrive after EAP-TLS is completed on BR. In this case they are handled by Initial EAPOL-key handler and the message and handler are deleted right away. The KMP receive message function however still referred to deleted handler which caused freed memory access. This is now corrected.
1 parent aecadc4 commit 3ec2a2c

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

source/Security/kmp/kmp_api.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -598,8 +598,7 @@ int8_t kmp_service_msg_if_receive(kmp_service_t *service, uint8_t instance_id, k
598598
int8_t ret = -1;
599599
if (kmp->sec_prot.receive != NULL) {
600600
ret = kmp->sec_prot.receive(&kmp->sec_prot, pdu, size);
601-
}
602-
if (kmp->sec_prot.conn_receive != NULL) {
601+
} else if (kmp->sec_prot.conn_receive != NULL) {
603602
ret = kmp->sec_prot.conn_receive(&kmp->sec_prot, pdu, size, connection_num);
604603
}
605604

0 commit comments

Comments
 (0)