Prevent crash in EAP-Fast if CHAP-Challenge is not the length we expect

diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c b/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
index 44e6bce7ad10c8153802ab92890c35f5448b0ec5..fa9c58f3c33517576bc8a648209c560e96ac5b3e 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
+++ b/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
@@ -770,6 +770,13 @@ static rlm_rcode_t CC_HINT(nonnull) process_reply( eap_handler_t *eap_session,
                for (vp = fr_cursor_init(&cursor, &reply->vps); vp; vp = fr_cursor_next(&cursor)) {
                        if (vp->da->vendor != VENDORPEC_MICROSOFT) continue;
 
+                       if (vp->vp_length != 16) {
+                               REDEBUG("Found CHAP-Challenge with incorrect length.  Expected %u, got %zu",
+                                       16, vp->vp_length);
+                               rcode = RLM_MODULE_INVALID;
+                               break;
+                       }
+
                        /* FIXME must be a better way to capture/re-derive this later for ISK */
                        switch (vp->da->attr) {
                        case PW_MSCHAP_MPPE_SEND_KEY: