diff options
Diffstat (limited to 'net-wireless/hostapd/files/hostapd-1.0-tls_length_fix.patch')
| -rw-r--r-- | net-wireless/hostapd/files/hostapd-1.0-tls_length_fix.patch | 48 |
1 files changed, 0 insertions, 48 deletions
diff --git a/net-wireless/hostapd/files/hostapd-1.0-tls_length_fix.patch b/net-wireless/hostapd/files/hostapd-1.0-tls_length_fix.patch deleted file mode 100644 index bda92cf4..00000000 --- a/net-wireless/hostapd/files/hostapd-1.0-tls_length_fix.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 586c446e0ff42ae00315b014924ec669023bd8de Mon Sep 17 00:00:00 2001 -From: Jouni Malinen <j@w1.fi> -Date: Sun, 7 Oct 2012 20:06:29 +0300 -Subject: [PATCH] EAP-TLS server: Fix TLS Message Length validation - -EAP-TLS/PEAP/TTLS/FAST server implementation did not validate TLS -Message Length value properly and could end up trying to store more -information into the message buffer than the allocated size if the first -fragment is longer than the indicated size. This could result in hostapd -process terminating in wpabuf length validation. Fix this by rejecting -messages that have invalid TLS Message Length value. - -This would affect cases that use the internal EAP authentication server -in hostapd either directly with IEEE 802.1X or when using hostapd as a -RADIUS authentication server and when receiving an incorrectly -constructed EAP-TLS message. Cases where hostapd uses an external -authentication are not affected. - -Thanks to Timo Warns for finding and reporting this issue. - -Signed-hostap: Jouni Malinen <j@w1.fi> -intended-for: hostap-1 ---- - src/eap_server/eap_server_tls_common.c | 8 ++++++++ - 1 files changed, 8 insertions(+), 0 deletions(-) - -diff --git a/src/eap_server/eap_server_tls_common.c b/src/eap_server/eap_server_tls_common.c -index 31be2ec..46f282b 100644 ---- a/src/eap_server/eap_server_tls_common.c -+++ b/src/eap_server/eap_server_tls_common.c -@@ -228,6 +228,14 @@ static int eap_server_tls_process_fragment(struct eap_ssl_data *data, - return -1; - } - -+ if (len > message_length) { -+ wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in " -+ "first fragment of frame (TLS Message " -+ "Length %d bytes)", -+ (int) len, (int) message_length); -+ return -1; -+ } -+ - data->tls_in = wpabuf_alloc(message_length); - if (data->tls_in == NULL) { - wpa_printf(MSG_DEBUG, "SSL: No memory for message"); --- -1.7.4-rc1 - |