On Fri, Sep 11, 2015 at 09:18:18PM +0200, Maxime Villard wrote:
> _18/ UNINITIALIZED VARIABLE: sys/net80211/ieee80211_pae_output.c rev1.20
This code is correct but I can see how it's hard to tell for a code scanner.
The only cases are PROTO_RSN and PROTO_WPA but these are bit flags.
This is an attempt to make the code more readable for both humans and scanners.
Also make sure that k is initialized to NULL in the WPA case.
Index: ieee80211_pae_output.c
===================================================================
RCS file: /cvs/src/sys/net80211/ieee80211_pae_output.c,v
retrieving revision 1.20
diff -u -p -r1.20 ieee80211_pae_output.c
--- ieee80211_pae_output.c 14 Mar 2015 03:38:51 -0000 1.20
+++ ieee80211_pae_output.c 16 Sep 2015 09:00:02 -0000
@@ -368,7 +368,7 @@ int
ieee80211_send_4way_msg3(struct ieee80211com *ic, struct ieee80211_node *ni)
{
struct ieee80211_eapol_key *key;
- struct ieee80211_key *k;
+ struct ieee80211_key *k = NULL;
struct mbuf *m;
u_int16_t info, keylen;
u_int8_t *frm;
@@ -380,14 +380,16 @@ ieee80211_send_4way_msg3(struct ieee8021
ieee80211_node_leave(ic, ni);
return 0;
}
- if (ni->ni_rsnprotos == IEEE80211_PROTO_RSN)
+ if (ni->ni_rsnprotos == IEEE80211_PROTO_RSN) {
k = &ic->ic_nw_keys[ic->ic_def_txkey];
-
- m = ieee80211_get_eapol_key(M_DONTWAIT, MT_DATA,
- ((ni->ni_rsnprotos == IEEE80211_PROTO_WPA) ?
- 2 + IEEE80211_WPAIE_MAXLEN :
- 2 + IEEE80211_RSNIE_MAXLEN + 2 + 6 + k->k_len + 15) +
- ((ni->ni_flags & IEEE80211_NODE_MFP) ? 2 + 28 : 0));
+ m = ieee80211_get_eapol_key(M_DONTWAIT, MT_DATA,
+ 2 + IEEE80211_RSNIE_MAXLEN + 2 + 6 + k->k_len + 15 +
+ ((ni->ni_flags & IEEE80211_NODE_MFP) ? 2 + 28 : 0));
+ } else { /* WPA */
+ m = ieee80211_get_eapol_key(M_DONTWAIT, MT_DATA,
+ 2 + IEEE80211_WPAIE_MAXLEN +
+ ((ni->ni_flags & IEEE80211_NODE_MFP) ? 2 + 28 : 0));
+ }
if (m == NULL)
return ENOMEM;
key = mtod(m, struct ieee80211_eapol_key *);
