diff options
| author | Natanael Copa <ncopa@alpinelinux.org> | 2015-06-15 11:17:48 +0000 |
|---|---|---|
| committer | Natanael Copa <ncopa@alpinelinux.org> | 2015-06-15 11:17:48 +0000 |
| commit | fd324ccbd51905c0571336037f4b4a09b8480170 (patch) | |
| tree | ee3c2c2000722d8c437cb6e817c47b493645b4af /main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch | |
| parent | 42682b17f2f86c202d38b55623589d1d2c376a31 (diff) | |
| download | aports-fd324ccbd51905c0571336037f4b4a09b8480170.tar.bz2 aports-fd324ccbd51905c0571336037f4b4a09b8480170.tar.xz | |
main/wpa_supplicant: various security fixes
CVE-2015-4141
CVE-2015-4142
CVE-2015-4143
CVE-2015-4144
CVE-2015-4145
CVE-2015-4146
ref #4339
ref #4266
Diffstat (limited to 'main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch')
| -rw-r--r-- | main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch b/main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch new file mode 100644 index 0000000000..a601323f14 --- /dev/null +++ b/main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch @@ -0,0 +1,32 @@ +From 28a069a545b06b99eb55ad53f63f2c99e65a98f6 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j@w1.fi> +Date: Sat, 2 May 2015 19:26:28 +0300 +Subject: [PATCH 5/5] EAP-pwd peer: Fix asymmetric fragmentation behavior + +The L (Length) and M (More) flags needs to be cleared before deciding +whether the locally generated response requires fragmentation. This +fixes an issue where these flags from the server could have been invalid +for the following message. In some cases, this could have resulted in +triggering the wpabuf security check that would terminate the process +due to invalid buffer allocation. + +Signed-off-by: Jouni Malinen <j@w1.fi> +--- + src/eap_peer/eap_pwd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c +index 1d2079b..e58b13a 100644 +--- a/src/eap_peer/eap_pwd.c ++++ b/src/eap_peer/eap_pwd.c +@@ -968,6 +968,7 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret, + /* + * we have output! Do we need to fragment it? + */ ++ lm_exch = EAP_PWD_GET_EXCHANGE(lm_exch); + len = wpabuf_len(data->outbuf); + if ((len + EAP_PWD_HDR_SIZE) > data->mtu) { + resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, data->mtu, +-- +1.9.1 + |