From e8c08c9a363340c45baf8e13c758c99078bc0d8b Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sat, 26 Jul 2014 21:12:49 +0300 Subject: [PATCH] EAP-FAST server: Fix potential read-after-buffer (by one byte) The special PAC_OPAQUE_TYPE_PAD case did not skip incrementing of the pos pointer and could result in one octet read-after-buffer when parsing the PAC-Opaque data. Signed-off-by: Jouni Malinen --- src/eap_server/eap_server_fast.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/eap_server/eap_server_fast.c b/src/eap_server/eap_server_fast.c index 102451014..4691e7228 100644 --- a/src/eap_server/eap_server_fast.c +++ b/src/eap_server/eap_server_fast.c @@ -187,7 +187,7 @@ static int eap_fast_session_ticket_cb(void *ctx, const u8 *ticket, size_t len, switch (*pos) { case PAC_OPAQUE_TYPE_PAD: pos = end; - break; + goto done; case PAC_OPAQUE_TYPE_KEY: if (pos[1] != EAP_FAST_PAC_KEY_LEN) { wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid " @@ -218,6 +218,7 @@ static int eap_fast_session_ticket_cb(void *ctx, const u8 *ticket, size_t len, pos += 2 + pos[1]; } +done: if (pac_key == NULL) { wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC-Key included in "