aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@openwrt.org>2012-10-17 18:16:56 +0000
committerFelix Fietkau <nbd@openwrt.org>2012-10-17 18:16:56 +0000
commit26944502e3ac3625b25a2911894bcdd252e39b30 (patch)
treec639a0110f57757b8628618d5f3ee676b02ed9e9
parentc6ba19c70e1bde7cb94c77ae64537294cfef2ae9 (diff)
downloadupstream-26944502e3ac3625b25a2911894bcdd252e39b30.tar.gz
upstream-26944502e3ac3625b25a2911894bcdd252e39b30.tar.bz2
upstream-26944502e3ac3625b25a2911894bcdd252e39b30.zip
hostapd: merge a security fix for a TLS message buffer overflow (CVE-2012-4445)
SVN-Revision: 33815
-rw-r--r--package/network/services/hostapd/patches/001-CVE-2012-4445.patch17
1 files changed, 17 insertions, 0 deletions
diff --git a/package/network/services/hostapd/patches/001-CVE-2012-4445.patch b/package/network/services/hostapd/patches/001-CVE-2012-4445.patch
new file mode 100644
index 0000000000..1b8bdd00c5
--- /dev/null
+++ b/package/network/services/hostapd/patches/001-CVE-2012-4445.patch
@@ -0,0 +1,17 @@
+--- a/src/eap_server/eap_server_tls_common.c
++++ b/src/eap_server/eap_server_tls_common.c
+@@ -228,6 +228,14 @@ static int eap_server_tls_process_fragme
+ return -1;
+ }
+
++ if (len > message_length) {
++ wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in "
++ "first fragment of frame (TLS Message "
++ "Length %d bytes)",
++ (int) len, (int) message_length);
++ return -1;
++ }
++
+ data->tls_in = wpabuf_alloc(message_length);
+ if (data->tls_in == NULL) {
+ wpa_printf(MSG_DEBUG, "SSL: No memory for message");