diff options
| author | nbd <nbd@3c298f89-4303-0410-b956-a3cf2f4a3e73> | 2012-10-17 18:18:17 +0000 |
|---|---|---|
| committer | nbd <nbd@3c298f89-4303-0410-b956-a3cf2f4a3e73> | 2012-10-17 18:18:17 +0000 |
| commit | b6aef12fcd2246e78fd4e327f49e33f975d6e13d (patch) | |
| tree | d35c416f214fc794f844b20c194bc4b752206ecd | |
| parent | aa5f9151561b618ffcef234f49bd3603437fe6a7 (diff) | |
| download | openwrt-b6aef12fcd2246e78fd4e327f49e33f975d6e13d.tar.gz openwrt-b6aef12fcd2246e78fd4e327f49e33f975d6e13d.zip | |
hostapd: merge a security fix for a TLS message buffer overflow (CVE-2012-4445)
Backport of r33815
git-svn-id: svn://svn.openwrt.org/openwrt/branches/attitude_adjustment@33816 3c298f89-4303-0410-b956-a3cf2f4a3e73
| -rw-r--r-- | package/hostapd/patches/001-CVE-2012-4445.patch | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/package/hostapd/patches/001-CVE-2012-4445.patch b/package/hostapd/patches/001-CVE-2012-4445.patch new file mode 100644 index 000000000..1b8bdd00c --- /dev/null +++ b/package/hostapd/patches/001-CVE-2012-4445.patch @@ -0,0 +1,17 @@ +--- a/src/eap_server/eap_server_tls_common.c ++++ b/src/eap_server/eap_server_tls_common.c +@@ -228,6 +228,14 @@ static int eap_server_tls_process_fragme + return -1; + } + ++ if (len > message_length) { ++ wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in " ++ "first fragment of frame (TLS Message " ++ "Length %d bytes)", ++ (int) len, (int) message_length); ++ return -1; ++ } ++ + data->tls_in = wpabuf_alloc(message_length); + if (data->tls_in == NULL) { + wpa_printf(MSG_DEBUG, "SSL: No memory for message"); |