6c40914c0c
- WPS: Fix HTTP chunked transfer encoding parser (CVE-2015-4141) - EAP-pwd peer: Fix payload length validation for Commit and Confirm (CVE-2015-4143) - EAP-pwd server: Fix payload length validation for Commit and Confirm (CVE-2015-4143) - EAP-pwd peer: Fix Total-Length parsing for fragment reassembly (CVE-2015-4144, CVE-2015-4145) - EAP-pwd server: Fix Total-Length parsing for fragment reassembly (CVE-2015-4144, CVE-2015-4145) - EAP-pwd peer: Fix asymmetric fragmentation behavior (CVE-2015-4146) - NFC: Fix payload length validation in NDEF record parser (CVE-2015-8041) - WNM: Ignore Key Data in WNM Sleep Mode Response frame if no PMF in use (CVE-2015-5310) - EAP-pwd peer: Fix last fragment length validation (CVE-2015-5315) - EAP-pwd server: Fix last fragment length validation (CVE-2015-5314) - EAP-pwd peer: Fix error path for unexpected Confirm message (CVE-2015-5316) Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> SVN-Revision: 48185
49 lines
1.8 KiB
Diff
49 lines
1.8 KiB
Diff
From 5acd23f4581da58683f3cf5e36cb71bbe4070bd7 Mon Sep 17 00:00:00 2001
|
|
From: Jouni Malinen <j@w1.fi>
|
|
Date: Tue, 28 Apr 2015 17:08:33 +0300
|
|
Subject: [PATCH] WPS: Fix HTTP chunked transfer encoding parser
|
|
|
|
strtoul() return value may end up overflowing the int h->chunk_size and
|
|
resulting in a negative value to be stored as the chunk_size. This could
|
|
result in the following memcpy operation using a very large length
|
|
argument which would result in a buffer overflow and segmentation fault.
|
|
|
|
This could have been used to cause a denial service by any device that
|
|
has been authorized for network access (either wireless or wired). This
|
|
would affect both the WPS UPnP functionality in a WPS AP (hostapd with
|
|
upnp_iface parameter set in the configuration) and WPS ER
|
|
(wpa_supplicant with WPS_ER_START control interface command used).
|
|
|
|
Validate the parsed chunk length value to avoid this. In addition to
|
|
rejecting negative values, we can also reject chunk size that would be
|
|
larger than the maximum configured body length.
|
|
|
|
Thanks to Kostya Kortchinsky of Google security team for discovering and
|
|
reporting this issue.
|
|
|
|
Signed-off-by: Jouni Malinen <j@w1.fi>
|
|
---
|
|
src/wps/httpread.c | 7 +++++++
|
|
1 file changed, 7 insertions(+)
|
|
|
|
diff --git a/src/wps/httpread.c b/src/wps/httpread.c
|
|
index 2f08f37..d2855e3 100644
|
|
--- a/src/wps/httpread.c
|
|
+++ b/src/wps/httpread.c
|
|
@@ -533,6 +533,13 @@ static void httpread_read_handler(int sd, void *eloop_ctx, void *sock_ctx)
|
|
if (!isxdigit(*cbp))
|
|
goto bad;
|
|
h->chunk_size = strtoul(cbp, NULL, 16);
|
|
+ if (h->chunk_size < 0 ||
|
|
+ h->chunk_size > h->max_bytes) {
|
|
+ wpa_printf(MSG_DEBUG,
|
|
+ "httpread: Invalid chunk size %d",
|
|
+ h->chunk_size);
|
|
+ goto bad;
|
|
+ }
|
|
/* throw away chunk header
|
|
* so we have only real data
|
|
*/
|
|
--
|
|
1.9.1
|
|
|