From 371c35612c504c6d56011f64920deb4cce217d47 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 16 Jun 2026 09:01:13 +0200 Subject: [PATCH] eap-aka-3gpp: Fix SQN generation As `tv_sec` is a `time_t`, i.e. typically 64 bits, assigning the result of `htonl()` leaves the upper 32 bits zero. Copying from the `sizeof(time_t) - 4` offset then copies those zeroes on little-endian systems, which is not what was intended according to the comments. Another issue was that the type of `tv_usec`, `suseconds_t`, is typically a `long`, i.e. signed, so shifting the maximum value 0x000f423f (999'999) by 12 bits technically overflows this. The cast fixes that. Fixes: 1aba82bfd736 ("eap-aka-3gpp: Add plugin that implements 3GPP MILENAGE algorithm in software") --- .../plugins/eap_aka_3gpp/eap_aka_3gpp_functions.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/libcharon/plugins/eap_aka_3gpp/eap_aka_3gpp_functions.c b/src/libcharon/plugins/eap_aka_3gpp/eap_aka_3gpp_functions.c index 2336ddc5d..215d40b26 100644 --- a/src/libcharon/plugins/eap_aka_3gpp/eap_aka_3gpp_functions.c +++ b/src/libcharon/plugins/eap_aka_3gpp/eap_aka_3gpp_functions.c @@ -106,14 +106,15 @@ bool eap_aka_3gpp_get_k_opc(identification_t *id, uint8_t k[AKA_K_LEN], void eap_aka_3gpp_get_sqn(uint8_t sqn[AKA_SQN_LEN], int offset) { timeval_t time; + uint32_t sec, usec; gettimeofday(&time, NULL); /* set sqn to an integer containing 4 bytes seconds + 2 bytes usecs */ - time.tv_sec = htonl(time.tv_sec + offset); + sec = htonl((uint32_t)(time.tv_sec + offset)); /* usec's are never larger than 0x000f423f, so we shift the 12 first bits */ - time.tv_usec = htonl(time.tv_usec << 12); - memcpy(sqn, (uint8_t*)&time.tv_sec + sizeof(time_t) - 4, 4); - memcpy(sqn + 4, &time.tv_usec, 2); + usec = htonl((uint32_t)time.tv_usec << 12); + memcpy(sqn, &sec, 4); + memcpy(sqn + 4, &usec, 2); } static bool f1andf1star(private_eap_aka_3gpp_functions_t *this,