From: Alan T. DeKok <aland@freeradius.org>
Date: Fri, 17 Nov 2017 21:02:00 +0000 (-0500)
Subject: check length before memcpy()
X-Git-Tag: release_3_0_16~45
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7e2e09ea60de3acd544543593fa635bf94bc01c1;p=thirdparty%2Ffreeradius-server.git

check length before memcpy()
---

diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c b/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
index 69070e5e288..c483e501842 100644
--- a/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
+++ b/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
@@ -1084,7 +1084,7 @@ static PW_CODE eap_fast_process_tlvs(REQUEST *request, eap_handler_t *eap_sessio
 				t->stage = PROVISIONING;
 				break;
 			case EAP_FAST_TLV_CRYPTO_BINDING:
-				if (!binding) {
+				if (!binding && (vp->vp_length >= (sizeof(eap_tlv_crypto_binding_tlv_t) - 4))) { {
 					binding = talloc_zero(request->packet, eap_tlv_crypto_binding_tlv_t);
 					memcpy(binding, vp->vp_octets, sizeof(*binding));
 					binding->tlv_type = htons(EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_CRYPTO_BINDING);