ikev2: Check the length of received COOKIE notifies

As specified by RFC 7296, section 2.6, the data associated with COOKIE
notifications MUST be between 1 and 64 octets in length (inclusive).

Fixes #3160.

diff --git a/src/libcharon/encoding/payloads/notify_payload.c b/src/libcharon/encoding/payloads/notify_payload.c
index a69db935772b6e19cd69dc2df434e10f8f81a60f..fc5c198020ffd64edbe9b6b30df745527d80f62e 100644 (file)
--- a/src/libcharon/encoding/payloads/notify_payload.c
+++ b/src/libcharon/encoding/payloads/notify_payload.c
@@ -467,6 +467,14 @@ METHOD(payload_t, verify, status_t,
                        }
                        break;
                }
+               case COOKIE:
+               {
+                       if (this->notify_data.len < 1 || this->notify_data.len > 64)
+                       {
+                               bad_length = TRUE;
+                       }
+                       break;
+               }
                case ADDITIONAL_IP4_ADDRESS:
                {
                        if (this->notify_data.len != 4)