[src/trunk]: src/external/bsd/wpa/dist/src The length of the received Commit ...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/217193cc6fd3
branches:  trunk
changeset: 338078:217193cc6fd3
user:      christos <christos%NetBSD.org@localhost>
date:      Sat May 09 19:46:01 2015 +0000

description:
The length of the received Commit and Confirm message payloads was not
checked before reading them. This could result in a buffer read
overflow when processing an invalid message.

Fix this by verifying that the payload is of expected length before
processing it. In addition, enforce correct state transition sequence to
make sure there is no unexpected behavior if receiving a Commit/Confirm
message before the previous exchanges have been completed.

Thanks to Kostya Kortchinsky of Google security team for discovering and
reporting this issue.

XXX: pullup-7

diffstat:

 external/bsd/wpa/dist/src/eap_peer/eap_pwd.c          |  17 +++++++++++++++++
 external/bsd/wpa/dist/src/eap_server/eap_server_pwd.c |  12 ++++++++++++
 2 files changed, 29 insertions(+), 0 deletions(-)

diffs (52 lines):

diff -r 04d2ca47f38f -r 217193cc6fd3 external/bsd/wpa/dist/src/eap_peer/eap_pwd.c
--- a/external/bsd/wpa/dist/src/eap_peer/eap_pwd.c      Sat May 09 19:35:15 2015 +0000
+++ b/external/bsd/wpa/dist/src/eap_peer/eap_pwd.c      Sat May 09 19:46:01 2015 +0000
@@ -301,6 +301,23 @@
        BIGNUM *mask = NULL, *x = NULL, *y = NULL, *cofactor = NULL;
        u16 offset;
        u8 *ptr, *scalar = NULL, *element = NULL;
+       size_t prime_len, order_len;
+
+       if (data->state != PWD_Commit_Req) {
+               ret->ignore = TRUE;
+               goto fin;
+       }
+
+       prime_len = BN_num_bytes(data->grp->prime);
+       order_len = BN_num_bytes(data->grp->order);
+
+       if (payload_len != 2 * prime_len + order_len) {
+               wpa_printf(MSG_INFO,
+                          "EAP-pwd: Unexpected Commit payload length %u (expected %u)",
+                          (unsigned int) payload_len,
+                          (unsigned int) (2 * prime_len + order_len));
+               goto fin;
+       }
 
        if (((data->private_value = BN_new()) == NULL) ||
            ((data->my_element = EC_POINT_new(data->grp->group)) == NULL) ||
diff -r 04d2ca47f38f -r 217193cc6fd3 external/bsd/wpa/dist/src/eap_server/eap_server_pwd.c
--- a/external/bsd/wpa/dist/src/eap_server/eap_server_pwd.c     Sat May 09 19:35:15 2015 +0000
+++ b/external/bsd/wpa/dist/src/eap_server/eap_server_pwd.c     Sat May 09 19:46:01 2015 +0000
@@ -634,9 +634,21 @@
        BIGNUM *x = NULL, *y = NULL, *cofactor = NULL;
        EC_POINT *K = NULL, *point = NULL;
        int res = 0;
+       size_t prime_len, order_len;
 
        wpa_printf(MSG_DEBUG, "EAP-pwd: Received commit response");
 
+       prime_len = BN_num_bytes(data->grp->prime);
+       order_len = BN_num_bytes(data->grp->order);
+
+       if (payload_len != 2 * prime_len + order_len) {
+               wpa_printf(MSG_INFO,
+                          "EAP-pwd: Unexpected Commit payload length %u (expected %u)",
+                          (unsigned int) payload_len,
+                          (unsigned int) (2 * prime_len + order_len));
+               goto fin;
+       }
+
        if (((data->peer_scalar = BN_new()) == NULL) ||
            ((data->k = BN_new()) == NULL) ||
            ((cofactor = BN_new()) == NULL) ||