diff options
| author | Jouni Malinen <j@w1.fi> | 2015-05-02 19:23:04 +0300 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2015-05-31 16:05:53 -0700 |
| commit | 803f4d734eddebf95cd306e7a6e94ba62e36fcb9 (patch) | |
| tree | b04f42237815cab2cb9b7091fd59bfcbefc1629e /src | |
| parent | 2f158854ce30b7e7d02027d9abd93e3c9e5da21e (diff) | |
| download | android_external_wpa_supplicant_8-803f4d734eddebf95cd306e7a6e94ba62e36fcb9.tar.gz android_external_wpa_supplicant_8-803f4d734eddebf95cd306e7a6e94ba62e36fcb9.tar.bz2 android_external_wpa_supplicant_8-803f4d734eddebf95cd306e7a6e94ba62e36fcb9.zip | |
EAP-pwd peer: Fix Total-Length parsing for fragment reassembly.
The remaining number of bytes in the message could be smaller than the
Total-Length field size, so the length needs to be explicitly checked
prior to reading the field and decrementing the len variable. This could
have resulted in the remaining length becoming negative and interpreted
as a huge positive integer.
In addition, check that there is no already started fragment in progress
before allocating a new buffer for reassembling fragments. This avoid a
potential memory leak when processing invalid message.
CRs-Fixed: 833592
Git-commit: 477c74395acd0123340457ba6f15ab345d42016e
Git-repo : git://w1.fi/srv/git/hostap.git
Signed-off-by: Jouni Malinen <j@w1.fi>
Change-Id: I9d55b2a7825c749c79f1b0ef73bd3b16516df834
Diffstat (limited to 'src')
| -rw-r--r-- | src/eap_peer/eap_pwd.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c index 669d2d2b..4642527c 100644 --- a/src/eap_peer/eap_pwd.c +++ b/src/eap_peer/eap_pwd.c @@ -812,11 +812,23 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret, * if it's the first fragment there'll be a length field */ if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) { + if (len < 2) { + wpa_printf(MSG_DEBUG, + "EAP-pwd: Frame too short to contain Total-Length field"); + ret->ignore = TRUE; + return NULL; + } tot_len = WPA_GET_BE16(pos); wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments whose " "total length = %d", tot_len); if (tot_len > 15000) return NULL; + if (data->inbuf) { + wpa_printf(MSG_DEBUG, + "EAP-pwd: Unexpected new fragment start when previous fragment is still in use"); + ret->ignore = TRUE; + return NULL; + } data->inbuf = wpabuf_alloc(tot_len); if (data->inbuf == NULL) { wpa_printf(MSG_INFO, "Out of memory to buffer " |