Skip to content

Commit 8631f5d

Browse files
sarveshb14espressif-bot
authored andcommitted
fix(wifi): prevent crash in WPS-registrar due to nested 'eap_wsc_reset()' calls
When a WPS handshake is already in progress and the enrollee sends another EAPOL-Start (e.g., due to missed packets or timeout), the registrar resets its state by calling 'eap_wsc_reset()'. This function frees 'sm->eap_method_priv' and then calls 'esp_wifi_ap_wps_disable()', which internally triggers another call to 'eap_wsc_reset()'. This results in a double reset where the second invocation accesses the already freed 'sm->eap_method_priv', leading to a crash. This fix sets 'sm->eap_method_priv' to NULL immediately after freeing it to ensure any subsequent calls to eap_wsc_reset() do not access an invalid pointer.
1 parent 9651200 commit 8631f5d

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

components/wpa_supplicant/src/eap_server/eap_server_wsc.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,7 @@ static void eap_wsc_reset(struct eap_sm *sm, void *priv)
104104
//wps_deinit(data->wps);
105105
os_free(data);
106106
#ifdef ESP_SUPPLICANT
107+
sm->eap_method_priv = NULL;
107108
/* TODO: When wps-registrar is shifted in a separate task other than wifi task,
108109
* call esp_wifi_ap_wps_disable() here instead of wifi_ap_wps_disable_internal()
109110
* */

0 commit comments

Comments
 (0)