aboutsummaryrefslogtreecommitdiffstats
path: root/main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch
diff options
context:
space:
mode:
authorNatanael Copa <ncopa@alpinelinux.org>2015-06-15 11:17:48 +0000
committerNatanael Copa <ncopa@alpinelinux.org>2015-06-15 11:28:06 +0000
commit62ecb530d43d5bdf1a68d3509993e48bddfdb5de (patch)
tree3f0bb39fb05b0800fa6ac632d7bfabbca7a107c7 /main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch
parent40a336eeadfbb7ec270160c4879021bb087084be (diff)
downloadaports-62ecb530d43d5bdf1a68d3509993e48bddfdb5de.tar.bz2
aports-62ecb530d43d5bdf1a68d3509993e48bddfdb5de.tar.xz
main/wpa_supplicant: various security fixes
Diffstat (limited to 'main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch')
-rw-r--r--main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch32
1 files changed, 32 insertions, 0 deletions
diff --git a/main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch b/main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch
new file mode 100644
index 0000000000..a601323f14
--- /dev/null
+++ b/main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch
@@ -0,0 +1,32 @@
+From 28a069a545b06b99eb55ad53f63f2c99e65a98f6 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Sat, 2 May 2015 19:26:28 +0300
+Subject: [PATCH 5/5] EAP-pwd peer: Fix asymmetric fragmentation behavior
+
+The L (Length) and M (More) flags needs to be cleared before deciding
+whether the locally generated response requires fragmentation. This
+fixes an issue where these flags from the server could have been invalid
+for the following message. In some cases, this could have resulted in
+triggering the wpabuf security check that would terminate the process
+due to invalid buffer allocation.
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ src/eap_peer/eap_pwd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c
+index 1d2079b..e58b13a 100644
+--- a/src/eap_peer/eap_pwd.c
++++ b/src/eap_peer/eap_pwd.c
+@@ -968,6 +968,7 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret,
+ /*
+ * we have output! Do we need to fragment it?
+ */
++ lm_exch = EAP_PWD_GET_EXCHANGE(lm_exch);
+ len = wpabuf_len(data->outbuf);
+ if ((len + EAP_PWD_HDR_SIZE) > data->mtu) {
+ resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, data->mtu,
+--
+1.9.1
+