From db3f4c2955f350048bf0a879eb8d5a83497071d0 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 22 Jun 2026 16:42:32 +0200 Subject: [PATCH] eap-radius: Avoid NULL-pointer dereference in XAuth backend Fixes: c434b2a4a9f5 ("eap-radius: support plain XAuth RADIUS authentication using User-Password") --- src/libcharon/plugins/eap_radius/eap_radius_xauth.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/libcharon/plugins/eap_radius/eap_radius_xauth.c b/src/libcharon/plugins/eap_radius/eap_radius_xauth.c index 4c4428b48..9793657f2 100644 --- a/src/libcharon/plugins/eap_radius/eap_radius_xauth.c +++ b/src/libcharon/plugins/eap_radius/eap_radius_xauth.c @@ -184,7 +184,10 @@ METHOD(xauth_method_t, process, status_t, /* trim password to any null termination. As User-Password * uses null padding, we can't have any null in it, and some * clients actually send null terminated strings (Android). */ - pass.len = strnlen(pass.ptr, pass.len); + if (pass.ptr) + { + pass.len = strnlen(pass.ptr, pass.len); + } } } enumerator->destroy(enumerator);