tree 362bfbdb11c4025ee6a52227c5984249753bc9f9
parent fdb708a37d8f7f1483e3cd4e8ded974f53fedace
author Jouni Malinen <j@w1.fi> 1446394697 +0200
committer Dmitry Shmidt <dimitrysh@google.com> 1446852363 +0000

EAP-pwd peer: Fix last fragment length validation

All but the last fragment had their length checked against the remaining
room in the reassembly buffer. This allowed a suitably constructed last
fragment frame to try to add extra data that would go beyond the buffer.
The length validation code in wpabuf_put_data() prevents an actual
buffer write overflow from occurring, but this results in process
termination. (CVE-2015-5315)

Bug: 25510821

Change-Id: Ic509a6efedc3da9ff40f2842fab5547d087f64de
Signed-off-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>