[src/trunk]: src/external/bsd/wpa/dist/src/wps strtoul() return value may end...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/2e2969404b6e
branches:  trunk
changeset: 338076:2e2969404b6e
user:      christos <christos%NetBSD.org@localhost>
date:      Sat May 09 19:33:47 2015 +0000

description:
strtoul() return value may end up overflowing the int h->chunk_size and
resulting in a negative value to be stored as the chunk_size. This could
result in the following memcpy operation using a very large length
argument which would result in a buffer overflow and segmentation fault.

This could have been used to cause a denial service by any device that
has been authorized for network access (either wireless or wired). This
would affect both the WPS UPnP functionality in a WPS AP (hostapd with
upnp_iface parameter set in the configuration) and WPS ER
(wpa_supplicant with WPS_ER_START control interface command used).

Validate the parsed chunk length value to avoid this. In addition to
rejecting negative values, we can also reject chunk size that would be
larger than the maximum configured body length.

Thanks to Kostya Kortchinsky of Google security team for discovering and
reporting this issue.

XXX: pullup-7

diffstat:

 external/bsd/wpa/dist/src/wps/httpread.c |  7 +++++++
 1 files changed, 7 insertions(+), 0 deletions(-)

diffs (17 lines):

diff -r 8d1e28453dc0 -r 2e2969404b6e external/bsd/wpa/dist/src/wps/httpread.c
--- a/external/bsd/wpa/dist/src/wps/httpread.c  Sat May 09 19:01:53 2015 +0000
+++ b/external/bsd/wpa/dist/src/wps/httpread.c  Sat May 09 19:33:47 2015 +0000
@@ -533,6 +533,13 @@
                                        if (!isxdigit(*cbp))
                                                goto bad;
                                        h->chunk_size = strtoul(cbp, NULL, 16);
+                                       if (h->chunk_size < 0 ||
+                                           h->chunk_size > h->max_bytes) {
+                                               wpa_printf(MSG_DEBUG,
+                                                          "httpread: Invalid chunk size %d",
+                                                          h->chunk_size);
+                                               goto bad;
+                                       }
                                        /* throw away chunk header
                                         * so we have only real data
                                         */