File 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-... of Package wpa_supplicant

Overview Repositories Revisions Requests Users Attributes Meta

File 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch of Package wpa_supplicant (Revision 541aa8667281ab0394c5e9a2a77ef252)

Currently displaying revision 541aa8667281ab0394c5e9a2a77ef252 , Show latest

From 477c74395acd0123340457ba6f15ab345d42016e Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Sat, 2 May 2015 19:23:04 +0300
Subject: [PATCH 3/5] EAP-pwd peer: Fix Total-Length parsing for fragment
 reassembly

The remaining number of bytes in the message could be smaller than the
Total-Length field size, so the length needs to be explicitly checked
prior to reading the field and decrementing the len variable. This could
have resulted in the remaining length becoming negative and interpreted
as a huge positive integer.

In addition, check that there is no already started fragment in progress
before allocating a new buffer for reassembling fragments. This avoid a
potential memory leak when processing invalid message.

Signed-off-by: Jouni Malinen <j@w1.fi>
================================================================================
--- wpa_supplicant-2.2/src/eap_peer/eap_pwd.c
+++ wpa_supplicant-2.2/src/eap_peer/eap_pwd.c
@@ -808,9 +808,24 @@
 	 * if it's the first fragment there'll be a length field
 	 */
 	if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) {
+		if (len < 2) {
+			wpa_printf(MSG_DEBUG,
+				"EAP-pwd: Frame too short to contain Total-Length field");
+			ret->ignore = TRUE;
+			return NULL;
+		}
 		tot_len = WPA_GET_BE16(pos);
 		wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments whose "
 			   "total length = %d", tot_len);
+		if (tot_len > 15000)
+			return NULL;
+		if (data->inbuf) {
+			wpa_printf(MSG_DEBUG,
+				"EAP-pwd: Unexpected new fragment start when previous fragment is still in use");
+			ret->ignore = TRUE;
+			return NULL;
+		}
+
 		data->inbuf = wpabuf_alloc(tot_len);
 		if (data->inbuf == NULL) {
 			wpa_printf(MSG_INFO, "Out of memory to buffer "

Places

File 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch of Package wpa_supplicant (Revision 541aa8667281ab0394c5e9a2a77ef252)

Places