jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

PAE: Validate input before pointer

Browse source 
ieee802_1x_kay_decode_mkpdu() calls ieee802_1x_mka_i_in_peerlist()
before body_len has been checked on all segments.

ieee802_1x_kay_decode_mkpdu() and ieee802_1x_mka_i_in_peerlist() might
continue and thus underflow left_len even if it finds left_len to small
(or before checking).

Additionally, ieee802_1x_mka_dump_peer_body() might perform out of bound
reads in this case.

Fix this by checking left_len and aborting if too small early.

Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
This commit is contained in:
Michael Braun 2017-08-18 01:14:28 +02:00 committed by Jouni Malinen
parent fd35ed5bba
commit 0ad5893a2f
1 changed files with 12 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
src/pae/ieee802_1x_kay.c
View file

@ -964,21 +964,19 @@ ieee802_1x_mka_i_in_peerlist(struct ieee802_1x_mka_participant *participant,
body_len = get_mka_param_body_len(hdr); body_len = get_mka_param_body_len(hdr);
body_type = get_mka_param_body_type(hdr); body_type = get_mka_param_body_type(hdr);
if (body_type != MKA_LIVE_PEER_LIST && if (left_len < (MKA_HDR_LEN + MKA_ALIGN_LENGTH(body_len) + DEFAULT_ICV_LEN)) {
body_type != MKA_POTENTIAL_PEER_LIST)
continue;
ieee802_1x_mka_dump_peer_body(
(struct ieee802_1x_mka_peer_body *)pos);
if (left_len < (MKA_HDR_LEN + body_len + DEFAULT_ICV_LEN)) {
wpa_printf(MSG_ERROR, wpa_printf(MSG_ERROR,
"KaY: MKA Peer Packet Body Length (%zu bytes) is less than the Parameter Set Header Length (%zu bytes) + the Parameter Set Body Length (%zu bytes) + %d bytes of ICV", "KaY: MKA Peer Packet Body Length (%zu bytes) is less than the Parameter Set Header Length (%zu bytes) + the Parameter Set Body Length (%zu bytes) + %d bytes of ICV",
left_len, MKA_HDR_LEN, left_len, MKA_HDR_LEN,
body_len, DEFAULT_ICV_LEN); MKA_ALIGN_LENGTH(body_len),
continue; DEFAULT_ICV_LEN);
return FALSE;
} }
if (body_type != MKA_LIVE_PEER_LIST &&
body_type != MKA_POTENTIAL_PEER_LIST)
continue;
if ((body_len % 16) != 0) { if ((body_len % 16) != 0) {
wpa_printf(MSG_ERROR, wpa_printf(MSG_ERROR,
"KaY: MKA Peer Packet Body Length (%zu bytes) should be a multiple of 16 octets", "KaY: MKA Peer Packet Body Length (%zu bytes) should be a multiple of 16 octets",
@ -986,6 +984,9 @@ ieee802_1x_mka_i_in_peerlist(struct ieee802_1x_mka_participant *participant,
continue; continue;
} }
ieee802_1x_mka_dump_peer_body(
(struct ieee802_1x_mka_peer_body *)pos);
for (i = 0; i < body_len; for (i = 0; i < body_len;
i += sizeof(struct ieee802_1x_mka_peer_id)) { i += sizeof(struct ieee802_1x_mka_peer_id)) {
const struct ieee802_1x_mka_peer_id *peer_mi; const struct ieee802_1x_mka_peer_id *peer_mi;
@ -3018,7 +3019,7 @@ static int ieee802_1x_kay_decode_mkpdu(struct ieee802_1x_kay *kay,
"KaY: MKA Peer Packet Body Length (%zu bytes) is less than the Parameter Set Header Length (%zu bytes) + the Parameter Set Body Length (%zu bytes) + %d bytes of ICV", "KaY: MKA Peer Packet Body Length (%zu bytes) is less than the Parameter Set Header Length (%zu bytes) + the Parameter Set Body Length (%zu bytes) + %d bytes of ICV",
left_len, MKA_HDR_LEN, left_len, MKA_HDR_LEN,
body_len, DEFAULT_ICV_LEN); body_len, DEFAULT_ICV_LEN);
continue; return -1;
} }
if (handled[body_type]) if (handled[body_type])