| Message ID | cdca52a89b289dbef39c510e8b007b0c120fb175.1467374899.git.sd@queasysnail.net |
|---|---|
| State | Accepted |
| Headers | show |
diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c index 1d3faa12a7c9..4bcc7f6556d1 100644 --- a/src/pae/ieee802_1x_kay.c +++ b/src/pae/ieee802_1x_kay.c @@ -1156,7 +1156,7 @@ ieee802_1x_mka_encode_sak_use_body( u32 pn = 1; length = ieee802_1x_mka_get_sak_use_length(participant); - body = wpabuf_put(buf, sizeof(struct ieee802_1x_mka_sak_use_body)); + body = wpabuf_put(buf, length); body->type = MKA_SAK_USE; set_mka_param_body_len(body, length - MKA_HDR_LEN);
The room we actually use is length. This could also mess up the receiver, since it will advance by the actual length (as indicated by the parameter body's length), which could differ from the offset at which we stored the next item. Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> --- src/pae/ieee802_1x_kay.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)