jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

SAE: Avoid undefined behavior in pointer arithmetic

Browse source 
Reorder terms in a way that no invalid pointers are generated with
pos+len operations. end-pos is always defined (with a valid pos pointer)
while pos+len could end up pointing beyond the end pointer which would
be undefined behavior.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2015-10-18 18:49:56 +03:00
parent f88bcad015
commit 80c620dbd7
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
src/common/sae.c
View file

@ -923,7 +923,7 @@ static void sae_parse_commit_token(struct sae_data *sae, const u8 **pos,
const u8 *end, const u8 **token,
size_t *token_len)
{
if (*pos + (sae->tmp->ec ? 3 : 2) * sae->tmp->prime_len < end) {
if ((sae->tmp->ec ? 3 : 2) * sae->tmp->prime_len < end - *pos) {
size_t tlen = end - (*pos + (sae->tmp->ec ? 3 : 2) *
sae->tmp->prime_len);
wpa_hexdump(MSG_DEBUG, "SAE: Anti-Clogging Token", *pos, tlen);
@ -946,7 +946,7 @@ static u16 sae_parse_commit_scalar(struct sae_data *sae, const u8 **pos,
{
struct crypto_bignum *peer_scalar;
if (*pos + sae->tmp->prime_len > end) {
if (sae->tmp->prime_len > end - *pos) {
wpa_printf(MSG_DEBUG, "SAE: Not enough data for scalar");
return WLAN_STATUS_UNSPECIFIED_FAILURE;
}
@ -994,7 +994,7 @@ static u16 sae_parse_commit_element_ecc(struct sae_data *sae, const u8 *pos,
{
u8 prime[SAE_MAX_ECC_PRIME_LEN];
if (pos + 2 * sae->tmp->prime_len > end) {
if (2 * sae->tmp->prime_len > end - pos) {
wpa_printf(MSG_DEBUG, "SAE: Not enough data for "
"commit-element");
return WLAN_STATUS_UNSPECIFIED_FAILURE;
@ -1040,7 +1040,7 @@ static u16 sae_parse_commit_element_ffc(struct sae_data *sae, const u8 *pos,
struct crypto_bignum *res, *one;
const u8 one_bin[1] = { 0x01 };
if (pos + sae->tmp->prime_len > end) {
if (sae->tmp->prime_len > end - pos) {
wpa_printf(MSG_DEBUG, "SAE: Not enough data for "
"commit-element");
return WLAN_STATUS_UNSPECIFIED_FAILURE;
@ -1098,7 +1098,7 @@ u16 sae_parse_commit(struct sae_data *sae, const u8 *data, size_t len,
u16 res;
/* Check Finite Cyclic Group */
if (pos + 2 > end)
if (end - pos < 2)
return WLAN_STATUS_UNSPECIFIED_FAILURE;
res = sae_group_allowed(sae, allowed_groups, WPA_GET_LE16(pos));
if (res != WLAN_STATUS_SUCCESS)