EAP-pwd peer: Fix error path for unexpected Confirm message
If the Confirm message is received from the server before the Identity
exchange has been completed, the group has not yet been determined and
data->grp is NULL. The error path in eap_pwd_perform_confirm_exchange()
did not take this corner case into account and could end up
dereferencing a NULL pointer and terminating the process if invalid
message sequence is received. (CVE-2015-5316)
Signed-off-by: Jouni Malinen <j@w1.fi>
Git-commit: 95577884ca4fa76be91344ff7a8d5d1e6dc3da61
Git-repo: git://w1.fi/srv/git/hostap.git
Change-Id: I134a6ac3240d63fe43e5041fb462fa7288b1e4b6
CRs-Fixed: 937525
1 file changed