From: Jouni Malinen <j@w1.fi>
Date: Mon, 21 Dec 2015 22:03:44 +0000 (+0200)
Subject: EAP-EKE: Reject too long Prot() data when building a frame
X-Git-Tag: hostap_2_6~1124
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=13cb0a66d5ac4d4cda6cd565781a440229e642f0;p=thirdparty%2Fhostap.git

EAP-EKE: Reject too long Prot() data when building a frame

This error case in own buffer lengths being too short was not handled
properly. While this should not really happen since the wpabuf
allocation is made large for the fixed cases that are currently
supported, better make eap_eke_prot() safer if this functionally ever
gets extended with a longer buffer need.

Signed-off-by: Jouni Malinen <j@w1.fi>
---

diff --git a/src/eap_common/eap_eke_common.c b/src/eap_common/eap_eke_common.c
index 4dfdb3f9c..b603e32b3 100644
--- a/src/eap_common/eap_eke_common.c
+++ b/src/eap_common/eap_eke_common.c
@@ -635,6 +635,7 @@ int eap_eke_prot(struct eap_eke_session *sess,
 
 	if (*prot_len < block_size + data_len + pad + icv_len) {
 		wpa_printf(MSG_INFO, "EAP-EKE: Not enough room for Prot() data");
+		return -1;
 	}
 	pos = prot;