Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2025-01-29 08:14:02 -05:00
Code Issues Projects Releases Wiki Activity

EAP-GPSK: Clean up CSuite_List length validation (CID 62854)

Browse Source 
Use a local variable and size_t in length comparison to make this easier
for static analyzers to understand. In addition, set the return list and
list_len values at the end of the function, i.e., only in success case.
These do not change the actual behavior of the only caller for this
function, but clarifies what the helper function is doing.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2014-06-18 17:14:59 +03:00
parent 2dbc959699
commit 4075e2fe77
1 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/eap_peer/eap_gpsk.c
View File

@ -236,6 +236,8 @@ static const u8 * eap_gpsk_process_csuite_list(struct eap_sm *sm,
size_t *list_len,
const u8 *pos, const u8 *end)
{
size_t len;
if (pos == NULL)
return NULL;
@ -243,23 +245,25 @@ static const u8 * eap_gpsk_process_csuite_list(struct eap_sm *sm,
wpa_printf(MSG_DEBUG, "EAP-GPSK: Too short GPSK-1 packet");
return NULL;
}
*list_len = WPA_GET_BE16(pos);
len = WPA_GET_BE16(pos);
pos += 2;
if (end - pos < (int) *list_len) {
if (len > (size_t) (end - pos)) {
wpa_printf(MSG_DEBUG, "EAP-GPSK: CSuite_List overflow");
return NULL;
}
if (*list_len == 0 || (*list_len % sizeof(struct eap_gpsk_csuite))) {
if (len == 0 || (len % sizeof(struct eap_gpsk_csuite))) {
wpa_printf(MSG_DEBUG, "EAP-GPSK: Invalid CSuite_List len %lu",
(unsigned long) *list_len);
(unsigned long) len);
return NULL;
}
*list = pos;
pos += *list_len;
if (eap_gpsk_select_csuite(sm, data, *list, *list_len) < 0)
if (eap_gpsk_select_csuite(sm, data, pos, len) < 0)
return NULL;
*list = pos;
*list_len = len;
pos += len;
return pos;
}