[src/trunk]: src/external/bsd/wpa/dist/src/eap_server EXP-TLS server: Fix TLS...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/2097eb37be72
branches:  trunk
changeset: 781935:2097eb37be72
user:      christos <christos%NetBSD.org@localhost>
date:      Mon Oct 08 14:03:09 2012 +0000

description:
EXP-TLS server: Fix TLS Message Length validation:

    http://w1.fi/gitweb/gitweb.cgi?p=hostap.git;a=commitdiff;\
    h=586c446e0ff42ae00315b014924ec669023bd8de

http://www.pre-cert.de/advisories/PRE-SA-2012-07.txt

diffstat:

 external/bsd/wpa/dist/src/eap_server/eap_server_tls_common.c |  6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diffs (16 lines):

diff -r 7b0083860e7e -r 2097eb37be72 external/bsd/wpa/dist/src/eap_server/eap_server_tls_common.c
--- a/external/bsd/wpa/dist/src/eap_server/eap_server_tls_common.c      Mon Oct 08 01:45:11 2012 +0000
+++ b/external/bsd/wpa/dist/src/eap_server/eap_server_tls_common.c      Mon Oct 08 14:03:09 2012 +0000
@@ -223,6 +223,12 @@
                                   " over 64 kB)");
                        return -1;
                }
+               if (len > message_length) {
+                       wpa_printf(MSG_INFO, "SSL: Too much data (%zu bytes) "
+                                  "in first fragment of frame (TLS Message "
+                                  "Length %u bytes)", len, message_length);
+                       return -1;
+               }
 
                data->tls_in = wpabuf_alloc(message_length);
                if (data->tls_in == NULL) {