From 4104267e81b0a0acdb43f693a67f236b3237a719 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sun, 29 Nov 2015 20:53:20 +0200 Subject: [PATCH] Fix memory leak on NFC DH generation error path It was possible for some NFC DH generation error paths to leak memory since the old private/public key was not freed if an allocation failed. Signed-off-by: Jouni Malinen --- src/crypto/dh_group5.c | 1 + src/crypto/dh_groups.c | 7 ++++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/src/crypto/dh_group5.c b/src/crypto/dh_group5.c index ccdbfc812..425c848ac 100644 --- a/src/crypto/dh_group5.c +++ b/src/crypto/dh_group5.c @@ -15,6 +15,7 @@ void * dh5_init(struct wpabuf **priv, struct wpabuf **publ) { + wpabuf_free(*publ); *publ = dh_init(dh_groups_get(5), priv); if (*publ == NULL) return NULL; diff --git a/src/crypto/dh_groups.c b/src/crypto/dh_groups.c index 3aeb2bbc6..7912361ff 100644 --- a/src/crypto/dh_groups.c +++ b/src/crypto/dh_groups.c @@ -1218,14 +1218,19 @@ struct wpabuf * dh_init(const struct dh_group *dh, struct wpabuf **priv) pv_len = dh->prime_len; pv = wpabuf_alloc(pv_len); - if (pv == NULL) + if (pv == NULL) { + wpabuf_clear_free(*priv); + *priv = NULL; return NULL; + } if (crypto_mod_exp(dh->generator, dh->generator_len, wpabuf_head(*priv), wpabuf_len(*priv), dh->prime, dh->prime_len, wpabuf_mhead(pv), &pv_len) < 0) { wpabuf_clear_free(pv); wpa_printf(MSG_INFO, "DH: crypto_mod_exp failed"); + wpabuf_clear_free(*priv); + *priv = NULL; return NULL; } wpabuf_put(pv, pv_len);