diff options
| author | Jouni Malinen <j@w1.fi> | 2015-05-02 19:26:06 +0300 |
|---|---|---|
| committer | Michael Bestas <mikeioannina@gmail.com> | 2015-11-11 19:39:59 +0200 |
| commit | 84b0fb91020630c8b314c9b96d5d78cc9e562de1 (patch) | |
| tree | 5dceda1360841bffab2b6bc5c0201355c823a733 | |
| parent | dcf16cc5145ca4983555b750d56c897f1686c6e4 (diff) | |
| download | android_external_wpa_supplicant_8-84b0fb91020630c8b314c9b96d5d78cc9e562de1.tar.gz android_external_wpa_supplicant_8-84b0fb91020630c8b314c9b96d5d78cc9e562de1.tar.bz2 android_external_wpa_supplicant_8-84b0fb91020630c8b314c9b96d5d78cc9e562de1.zip | |
EAP-pwd server: Fix Total-Length parsing for fragment reassembly
The remaining number of bytes in the message could be smaller than the
Total-Length field size, so the length needs to be explicitly checked
prior to reading the field and decrementing the len variable. This could
have resulted in the remaining length becoming negative and interpreted
as a huge positive integer.
In addition, check that there is no already started fragment in progress
before allocating a new buffer for reassembling fragments. This avoid a
potential memory leak when processing invalid message.
Change-Id: I1501af3aefa3a9784704cbd8ec625f66b4bb5df5
Signed-off-by: Jouni Malinen <j@w1.fi>
| -rw-r--r-- | src/eap_server/eap_server_pwd.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/src/eap_server/eap_server_pwd.c b/src/eap_server/eap_server_pwd.c index 2308df00..ac0bd043 100644 --- a/src/eap_server/eap_server_pwd.c +++ b/src/eap_server/eap_server_pwd.c @@ -909,9 +909,19 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv, * the first fragment has a total length */ if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) { + if (len < 2) { + wpa_printf(MSG_DEBUG, + "EAP-pwd: Frame too short to contain Total-Length field"); + return; + } tot_len = WPA_GET_BE16(pos); wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments, total " "length = %d", tot_len); + if (data->inbuf) { + wpa_printf(MSG_DEBUG, + "EAP-pwd: Unexpected new fragment start when previous fragment is still in use"); + return; + } data->inbuf = wpabuf_alloc(tot_len); if (data->inbuf == NULL) { wpa_printf(MSG_INFO, "EAP-pwd: Out of memory to " |