6c40914c0c
- WPS: Fix HTTP chunked transfer encoding parser (CVE-2015-4141) - EAP-pwd peer: Fix payload length validation for Commit and Confirm (CVE-2015-4143) - EAP-pwd server: Fix payload length validation for Commit and Confirm (CVE-2015-4143) - EAP-pwd peer: Fix Total-Length parsing for fragment reassembly (CVE-2015-4144, CVE-2015-4145) - EAP-pwd server: Fix Total-Length parsing for fragment reassembly (CVE-2015-4144, CVE-2015-4145) - EAP-pwd peer: Fix asymmetric fragmentation behavior (CVE-2015-4146) - NFC: Fix payload length validation in NDEF record parser (CVE-2015-8041) - WNM: Ignore Key Data in WNM Sleep Mode Response frame if no PMF in use (CVE-2015-5310) - EAP-pwd peer: Fix last fragment length validation (CVE-2015-5315) - EAP-pwd server: Fix last fragment length validation (CVE-2015-5314) - EAP-pwd peer: Fix error path for unexpected Confirm message (CVE-2015-5316) Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> SVN-Revision: 48185
32 lines
1.2 KiB
Diff
32 lines
1.2 KiB
Diff
From 28a069a545b06b99eb55ad53f63f2c99e65a98f6 Mon Sep 17 00:00:00 2001
|
|
From: Jouni Malinen <j@w1.fi>
|
|
Date: Sat, 2 May 2015 19:26:28 +0300
|
|
Subject: [PATCH 5/5] EAP-pwd peer: Fix asymmetric fragmentation behavior
|
|
|
|
The L (Length) and M (More) flags needs to be cleared before deciding
|
|
whether the locally generated response requires fragmentation. This
|
|
fixes an issue where these flags from the server could have been invalid
|
|
for the following message. In some cases, this could have resulted in
|
|
triggering the wpabuf security check that would terminate the process
|
|
due to invalid buffer allocation.
|
|
|
|
Signed-off-by: Jouni Malinen <j@w1.fi>
|
|
---
|
|
src/eap_peer/eap_pwd.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c
|
|
index 1d2079b..e58b13a 100644
|
|
--- a/src/eap_peer/eap_pwd.c
|
|
+++ b/src/eap_peer/eap_pwd.c
|
|
@@ -968,6 +968,7 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret,
|
|
/*
|
|
* we have output! Do we need to fragment it?
|
|
*/
|
|
+ lm_exch = EAP_PWD_GET_EXCHANGE(lm_exch);
|
|
len = wpabuf_len(data->outbuf);
|
|
if ((len + EAP_PWD_HDR_SIZE) > data->mtu) {
|
|
resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, data->mtu,
|
|
--
|
|
1.9.1
|
|
|