buildroot

From 567bacefd73782508bfe72d3624df495f0df4cd1 Mon Sep 17 00:00:00 2001

From: Jouni Malinen <j@w1.fi>

Date: Sun, 7 Oct 2012 20:06:29 +0300

Subject: [PATCH] EAP-TLS server: Fix TLS Message Length validation

​

EAP-TLS/PEAP/TTLS/FAST server implementation did not validate TLS

Message Length value properly and could end up trying to store more

information into the message buffer than the allocated size if the first

fragment is longer than the indicated size. This could result in hostapd

process terminating in wpabuf length validation. Fix this by rejecting

messages that have invalid TLS Message Length value.

​

This would affect cases that use the internal EAP authentication server

in hostapd either directly with IEEE 802.1X or when using hostapd as a

RADIUS authentication server and when receiving an incorrectly

constructed EAP-TLS message. Cases where hostapd uses an external

authentication are not affected.

​

Thanks to Timo Warns for finding and reporting this issue.

​

Signed-hostap: Jouni Malinen <j@w1.fi>

intended-for: hostap-1

(cherry picked from commit 586c446e0ff42ae00315b014924ec669023bd8de)

---

 src/eap_server/eap_server_tls_common.c |    8 ++++++++

 1 files changed, 8 insertions(+), 0 deletions(-)

​

diff --git a/src/eap_server/eap_server_tls_common.c b/src/eap_server/eap_server_tls_common.c

index e149ee3..2cbe700 100644

--- a/src/eap_server/eap_server_tls_common.c

+++ b/src/eap_server/eap_server_tls_common.c

@@ -224,6 +224,14 @@ static int eap_server_tls_process_fragment(struct eap_ssl_data *data,

            return -1;

        }

+       if (len > message_length) {

+           wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in "

+                  "first fragment of frame (TLS Message "

+                  "Length %d bytes)",

+                  (int) len, (int) message_length);

+           return -1;

+       }

+

        data->tls_in = wpabuf_alloc(message_length);

        if (data->tls_in == NULL) {

            wpa_printf(MSG_DEBUG, "SSL: No memory for message");

-- 

1.7.4-rc1

​