From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Tue, 8 Jan 2019 10:22:14 +0000 (+0800)
Subject: Prevent crash in EAP-Fast if CHAP-Challenge is not the length we expect
X-Git-Tag: release_3_0_18~94
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=df2d3bceeb5d24534795e33620998f865de5a90c;p=thirdparty%2Ffreeradius-server.git

Prevent crash in EAP-Fast if CHAP-Challenge is not the length we expect
---

diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c b/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
index 44e6bce7ad1..fa9c58f3c33 100644
--- a/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
+++ b/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
@@ -770,6 +770,13 @@ static rlm_rcode_t CC_HINT(nonnull) process_reply( eap_handler_t *eap_session,
 		for (vp = fr_cursor_init(&cursor, &reply->vps); vp; vp = fr_cursor_next(&cursor)) {
 			if (vp->da->vendor != VENDORPEC_MICROSOFT) continue;
 
+			if (vp->vp_length != 16) {
+				REDEBUG("Found CHAP-Challenge with incorrect length.  Expected %u, got %zu",
+					16, vp->vp_length);
+				rcode = RLM_MODULE_INVALID;
+				break;
+			}
+
 			/* FIXME must be a better way to capture/re-derive this later for ISK */
 			switch (vp->da->attr) {
 			case PW_MSCHAP_MPPE_SEND_KEY: