mirror of
https://github.com/vanhoefm/fragattacks.git
synced 2025-02-23 12:23:07 -05:00
87fcb5a735
The req_plen argument to eap_pax_process_std_1() and eap_pax_process_std_3() could be smaller than sizeof(struct eap_pax_hdr) since the main processing function was only verifying that there is enough room for the ICV and then removed ICV length from the remaining payload length. In theory, this could have resulted in the size_t left parameter being set to a negative value that would be interpreted as a huge positive integer. That could then result in a small buffer read overflow and process termination if MSGDUMP debug verbosity was in use. In practice, it does not seem to be feasible to construct a short message that would be able to pass the ICV validation (calculated using HMAC-SHA1-128) even for the case where an empty password is used. Anyway, the implementation should really check the length explicitly instead of depending on implicit check through ICV validation. Signed-off-by: Jouni Malinen <j@w1.fi>