From 75b2a879524a34357f4705f5f7408c8974fe0ad5 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Mon, 4 Jul 2016 19:34:22 +0300 Subject: [PATCH] HS 2.0: Fix hs20_get_icon() error path If base64_encode() fails (e.g., due to memory allocation failure), the return value needs to be checked against NULL before using the (not really) returned length value. The error path here ended up reading uninitialized variable. Signed-off-by: Jouni Malinen --- wpa_supplicant/hs20_supplicant.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wpa_supplicant/hs20_supplicant.c b/wpa_supplicant/hs20_supplicant.c index a62c1c3..1d15677 100644 --- a/wpa_supplicant/hs20_supplicant.c +++ b/wpa_supplicant/hs20_supplicant.c @@ -320,7 +320,7 @@ int hs20_get_icon(struct wpa_supplicant *wpa_s, const u8 *bssid, return -1; b64 = base64_encode(&icon->image[offset], size, &b64_size); - if (buf_len >= b64_size) { + if (b64 && buf_len >= b64_size) { os_memcpy(reply, b64, b64_size); reply_size = b64_size; } else { -- 2.1.4