From 6590b6400f73762fc6a53ad6ca05a73246cc5e54 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Fri, 13 Jun 2014 16:03:45 +0300 Subject: [PATCH] EAP-TNC: Limit maximum message buffer to 75000 bytes (CID 62873) Since there is a limit on the EAP exchange due to maximum number of roundtrips, there is no point in allowing excessively large buffers to be allocated based on what the peer device claims the total message to be. Instead, reject the message if it would not be possible to receive it in full anyway. Signed-off-by: Jouni Malinen --- src/eap_peer/eap_tnc.c | 3 ++- src/eap_server/eap_server_tnc.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/eap_peer/eap_tnc.c b/src/eap_peer/eap_tnc.c index bc136470b..25b9f1248 100644 --- a/src/eap_peer/eap_tnc.c +++ b/src/eap_peer/eap_tnc.c @@ -243,7 +243,8 @@ static struct wpabuf * eap_tnc_process(struct eap_sm *sm, void *priv, message_length = WPA_GET_BE32(pos); pos += 4; - if (message_length < (u32) (end - pos)) { + if (message_length < (u32) (end - pos) || + message_length > 75000) { wpa_printf(MSG_DEBUG, "EAP-TNC: Invalid Message " "Length (%d; %ld remaining in this msg)", message_length, (long) (end - pos)); diff --git a/src/eap_server/eap_server_tnc.c b/src/eap_server/eap_server_tnc.c index 67a3dfa30..21bd26f82 100644 --- a/src/eap_server/eap_server_tnc.c +++ b/src/eap_server/eap_server_tnc.c @@ -480,7 +480,8 @@ static void eap_tnc_process(struct eap_sm *sm, void *priv, message_length = WPA_GET_BE32(pos); pos += 4; - if (message_length < (u32) (end - pos)) { + if (message_length < (u32) (end - pos) || + message_length > 75000) { wpa_printf(MSG_DEBUG, "EAP-TNC: Invalid Message " "Length (%d; %ld remaining in this msg)", message_length, (long) (end - pos));