jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

EAP-pwd server: Fix reassembly buffer handling

Browse source 
data->inbuf allocation might fail and if that were to happen, the next
fragment in the exchange could have resulted in NULL pointer
dereference. Unexpected fragment with more bit might also be able to
trigger this. Fix that by explicitly checking for data->inbuf to be
available before using it.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit is contained in:
Jouni Malinen 2019-04-17 01:55:32 +03:00 committed by Jouni Malinen
parent a9d224f560
commit fe76f487e2
1 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/eap_server/eap_server_pwd.c
View file

@ -912,6 +912,12 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv,
* the first and all intermediate fragments have the M bit set * the first and all intermediate fragments have the M bit set
*/ */
if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) { if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) {
if (!data->inbuf) {
wpa_printf(MSG_DEBUG,
"EAP-pwd: No buffer for reassembly");
eap_pwd_state(data, FAILURE);
return;
}
if ((data->in_frag_pos + len) > wpabuf_size(data->inbuf)) { if ((data->in_frag_pos + len) > wpabuf_size(data->inbuf)) {
wpa_printf(MSG_DEBUG, "EAP-pwd: Buffer overflow " wpa_printf(MSG_DEBUG, "EAP-pwd: Buffer overflow "
"attack detected! (%d+%d > %d)", "attack detected! (%d+%d > %d)",
@ -932,7 +938,7 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv,
* last fragment won't have the M bit set (but we're obviously * last fragment won't have the M bit set (but we're obviously
* buffering fragments so that's how we know it's the last) * buffering fragments so that's how we know it's the last)
*/ */
if (data->in_frag_pos) { if (data->in_frag_pos && data->inbuf) {
pos = wpabuf_head_u8(data->inbuf); pos = wpabuf_head_u8(data->inbuf);
len = data->in_frag_pos; len = data->in_frag_pos;
wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes", wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes",