[PATCH] EAP-MSCHAPv2: Fix NULL pointer arithmetic in failure message parsing

[Andrei Otcheretianski]

os_strchr() can return NULL when the C= challenge field is the last
field in the MSCHAPv2 failure message (no trailing space). The result
was used directly in pointer arithmetic without a NULL check, which is
undefined behavior.

Fix by storing the os_strchr() result and falling back to end-of-string
when no space delimiter is found.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski at intel.com>
---
 src/eap_peer/eap_mschapv2.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/eap_peer/eap_mschapv2.c b/src/eap_peer/eap_mschapv2.c
index e84ae16b47..e480014250 100644
--- a/src/eap_peer/eap_mschapv2.c
+++ b/src/eap_peer/eap_mschapv2.c
@@ -436,8 +436,13 @@ static int eap_mschapv2_failure_txt(struct eap_sm *sm,
 
 	if (pos && os_strncmp(pos, "C=", 2) == 0) {
 		int hex_len;
+		char *pos2;
 		pos += 2;
-		hex_len = os_strchr(pos, ' ') - (char *) pos;
+		pos2 = os_strchr(pos, ' ');
+		if (pos2)
+			hex_len = pos2 - pos;
+		else
+			hex_len = os_strlen(pos);
 		if (hex_len == PASSWD_CHANGE_CHAL_LEN * 2) {
 			if (hexstr2bin(pos, data->passwd_change_challenge,
 				       PASSWD_CHANGE_CHAL_LEN)) {
-- 
2.53.0