81f0769d04
- added patch for bnc#930077 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch - added patch for bnc#930078 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch - added patches for bnc#930079 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch OBS-URL: https://build.opensuse.org/request/show/305848 OBS-URL: https://build.opensuse.org/package/show/hardware/wpa_supplicant?expand=0&rev=56
33 lines
1.2 KiB
Diff
33 lines
1.2 KiB
Diff
From 28a069a545b06b99eb55ad53f63f2c99e65a98f6 Mon Sep 17 00:00:00 2001
|
|
From: Jouni Malinen <j@w1.fi>
|
|
Date: Sat, 2 May 2015 19:26:28 +0300
|
|
Subject: [PATCH 5/5] EAP-pwd peer: Fix asymmetric fragmentation behavior
|
|
|
|
The L (Length) and M (More) flags needs to be cleared before deciding
|
|
whether the locally generated response requires fragmentation. This
|
|
fixes an issue where these flags from the server could have been invalid
|
|
for the following message. In some cases, this could have resulted in
|
|
triggering the wpabuf security check that would terminate the process
|
|
due to invalid buffer allocation.
|
|
|
|
Signed-off-by: Jouni Malinen <j@w1.fi>
|
|
---
|
|
src/eap_peer/eap_pwd.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c
|
|
index 1d2079b..e58b13a 100644
|
|
--- a/src/eap_peer/eap_pwd.c
|
|
+++ b/src/eap_peer/eap_pwd.c
|
|
@@ -968,6 +968,7 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret,
|
|
/*
|
|
* we have output! Do we need to fragment it?
|
|
*/
|
|
+ lm_exch = EAP_PWD_GET_EXCHANGE(lm_exch);
|
|
len = wpabuf_len(data->outbuf);
|
|
if ((len + EAP_PWD_HDR_SIZE) > data->mtu) {
|
|
resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, data->mtu,
|
|
--
|
|
1.9.1
|
|
|