From adf96fb66b1f0606b8d4f4f5e01e33a10c95ee07 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sun, 23 Nov 2014 20:57:34 +0200 Subject: [PATCH] WPS: Add explicit message length limit of 50000 bytes Previously, this was implicitly limited by the 16-bit length field to 65535. This resulted in unhelpful static analyzer warnings (CID 62868). Add an explicit (but pretty arbitrary) limit of 50000 bytes to avoid this. The actual WSC messages are significantly shorter in practice, but there is no specific protocol limit, so 50000 is as good as any limit to use here. Signed-off-by: Jouni Malinen --- src/eap_peer/eap_wsc.c | 2 +- src/eap_server/eap_server_wsc.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/eap_peer/eap_wsc.c b/src/eap_peer/eap_wsc.c index 23e982372..7ce0a53d0 100644 --- a/src/eap_peer/eap_wsc.c +++ b/src/eap_peer/eap_wsc.c @@ -462,7 +462,7 @@ static struct wpabuf * eap_wsc_process(struct eap_sm *sm, void *priv, message_length = WPA_GET_BE16(pos); pos += 2; - if (message_length < end - pos) { + if (message_length < end - pos || message_length > 50000) { wpa_printf(MSG_DEBUG, "EAP-WSC: Invalid Message " "Length"); ret->ignore = TRUE; diff --git a/src/eap_server/eap_server_wsc.c b/src/eap_server/eap_server_wsc.c index 97ec0c0ea..9d9c28d70 100644 --- a/src/eap_server/eap_server_wsc.c +++ b/src/eap_server/eap_server_wsc.c @@ -380,7 +380,7 @@ static void eap_wsc_process(struct eap_sm *sm, void *priv, message_length = WPA_GET_BE16(pos); pos += 2; - if (message_length < end - pos) { + if (message_length < end - pos || message_length > 50000) { wpa_printf(MSG_DEBUG, "EAP-WSC: Invalid Message " "Length"); return;