[PATCH] sae: fix incorrect length adjustment

[PATCH] sae: fix incorrect length adjustment

[James Prestwood]

[-- Attachment #1: Type: text/plain, Size: 928 bytes --]

The commit/confirm processing was incorrectly subtracting 2 from
the length when they should be subtracting 6. As with the other
similar change, the length is validated with mpdu_validate so
subtracting 6 will not cause an overflow.
---
 src/sae.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/sae.c b/src/sae.c
index 327277eb..a17c2883 100644
--- a/src/sae.c
+++ b/src/sae.c
@@ -1037,10 +1037,10 @@ static int sae_rx_authenticate(struct auth_proto *ap,
 	switch (L_LE16_TO_CPU(auth->transaction_sequence)) {
 	case SAE_STATE_COMMITTED:
 		return sae_process_commit(sm, hdr->address_2, auth->ies,
-						len - 2);
+						len - 6);
 	case SAE_STATE_CONFIRMED:
 		return sae_process_confirm(sm, hdr->address_2, auth->ies,
-						len - 2);
+						len - 6);
 	default:
 		l_error("invalid transaction sequence %u",
 				L_LE16_TO_CPU(auth->transaction_sequence));
-- 
2.17.1

Re: [PATCH] sae: fix incorrect length adjustment

[Denis Kenzior]

[-- Attachment #1: Type: text/plain, Size: 427 bytes --]

Hi James,

On 10/21/19 4:59 PM, James Prestwood wrote:
> The commit/confirm processing was incorrectly subtracting 2 from
> the length when they should be subtracting 6. As with the other
> similar change, the length is validated with mpdu_validate so
> subtracting 6 will not cause an overflow.
> ---
>   src/sae.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)

Applied, thanks.

Regards,
-Denis