]> git.ipfire.org Git - thirdparty/hostap.git/commit
EAP-SIM/AKA: Fix check for anonymous decorated identity
authorJouni Malinen <j@w1.fi>
Sat, 20 Mar 2021 14:25:50 +0000 (16:25 +0200)
committerJouni Malinen <j@w1.fi>
Sat, 20 Mar 2021 14:28:44 +0000 (16:28 +0200)
commit3ae18d4bd71a6c1c446fa1e857d72acbef6853b8
tree24894fcd9e46f85827e1b0970ab5fb302019683c
parent512d973cc27c06e94d81a19216b2bb32e8ac15b1
EAP-SIM/AKA: Fix check for anonymous decorated identity

eap_sim_anonymous_username() gets called with an argument that is not a
null terminated C string and as such, os_strrchr() and os_strlen()
cannot be used with it. The previous implementation resulted in use of
uninitialized values and a potential read beyond the end of the buffer.

Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32277
Fixes: 73d9891bd722 ("EAP-SIM/AKA peer: Support decorated anonymous identity prefix")
Signed-off-by: Jouni Malinen <j@w1.fi>
src/eap_common/eap_sim_common.c