[wpa_supplicant] Cherry-pick security fixes (April 29, 2019)
09ab81b9e WPA: Clear authenticator keys for a STA on deinit/disconnection
7958223fd EAP-pwd: Use const_time_memcmp() for pwd_value >= prime comparison
8e14b030e SAE: Use const_time_memcmp() for pwd_value >= prime comparison
c3805fb62 Ignore channel switch event if AP interface is not yet ready
eb314e8af Verify that channel info is available in hostapd_hw_get_channel()
b9058266f Clear cached extended_capa pointers on hapd_deinit() call
Bug: 129344244
Test: Connect to SAE network
Test: Connect to EAP network
Test: Enable/disable SoftAP
Test: Regression test (Bug: 131703857)
Change-Id: Iac0d8a7972b905da0d0f0f7414f1eea910b8986b
diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c
index 616b205..e89a716 100644
--- a/src/ap/wpa_auth.c
+++ b/src/ap/wpa_auth.c
@@ -699,7 +699,7 @@
#ifdef CONFIG_DPP2
wpabuf_clear_free(sm->dpp_z);
#endif /* CONFIG_DPP2 */
- os_free(sm);
+ bin_clear_free(sm, sizeof(*sm));
}
@@ -1730,6 +1730,12 @@
case WPA_DEAUTH:
case WPA_DISASSOC:
sm->DeauthenticationRequest = TRUE;
+#ifdef CONFIG_IEEE80211R_AP
+ os_memset(sm->PMK, 0, sizeof(sm->PMK));
+ sm->pmk_len = 0;
+ os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
+ sm->xxkey_len = 0;
+#endif /* CONFIG_IEEE80211R_AP */
break;
case WPA_REAUTH:
case WPA_REAUTH_EAPOL: