diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2015-08-27 15:15:04 +0200 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2015-08-27 15:29:16 +0200 |
| commit | fbb593092e39bc096eabcadc635e13468ec8cc7a (patch) | |
| tree | ed19dcce65450a575a042b9b55c6f17885a93402 /src | |
| parent | 03024f4ca8566efd98e95ffe29a33c95733ad832 (diff) | |
| download | strongswan-fbb593092e39bc096eabcadc635e13468ec8cc7a.tar.bz2 strongswan-fbb593092e39bc096eabcadc635e13468ec8cc7a.tar.xz | |
eap-ttls: Limit maximum length of tunneled EAP packet to EAP-TTLS packet
Diffstat (limited to 'src')
| -rw-r--r-- | src/libcharon/plugins/eap_ttls/eap_ttls_peer.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c index 66c9deed8..e0b59a681 100644 --- a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c +++ b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c @@ -112,6 +112,13 @@ METHOD(tls_application_t, process, status_t, eap_data = avp_data; break; } + else if (eap_len > reader->remaining(reader) + avp_data.len) + { + /* rough size check, ignoring AVP headers in remaining data */ + DBG1(DBG_IKE, "EAP packet too large for EAP-TTLS AVP(s)"); + chunk_free(&avp_data); + return FAILED; + } else if (avp_data.len == MAX_RADIUS_ATTRIBUTE_SIZE) { /* non-standard: EAP packet segmented into multiple AVPs */ @@ -128,7 +135,7 @@ METHOD(tls_application_t, process, status_t, if (avp_data.len > eap_data.len - eap_pos) { - DBG1(DBG_IKE, "AVP size to large to fit into EAP packet"); + DBG1(DBG_IKE, "AVP size too large to fit into EAP packet"); chunk_free(&avp_data); chunk_free(&eap_data); return FAILED; |