| 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950 |
- From 5acd23f4581da58683f3cf5e36cb71bbe4070bd7 Mon Sep 17 00:00:00 2001
- From: Jouni Malinen <j@w1.fi>
- Date: Tue, 28 Apr 2015 17:08:33 +0300
- Subject: [PATCH] WPS: Fix HTTP chunked transfer encoding parser
- strtoul() return value may end up overflowing the int h->chunk_size and
- resulting in a negative value to be stored as the chunk_size. This could
- result in the following memcpy operation using a very large length
- argument which would result in a buffer overflow and segmentation fault.
- This could have been used to cause a denial service by any device that
- has been authorized for network access (either wireless or wired). This
- would affect both the WPS UPnP functionality in a WPS AP (hostapd with
- upnp_iface parameter set in the configuration) and WPS ER
- (wpa_supplicant with WPS_ER_START control interface command used).
- Validate the parsed chunk length value to avoid this. In addition to
- rejecting negative values, we can also reject chunk size that would be
- larger than the maximum configured body length.
- Thanks to Kostya Kortchinsky of Google security team for discovering and
- reporting this issue.
- Signed-off-by: Jouni Malinen <j@w1.fi>
- Signed-off-by: Baruch Siach <baruch@tkos.co.il>
- ---
- src/wps/httpread.c | 7 +++++++
- 1 file changed, 7 insertions(+)
- diff --git a/src/wps/httpread.c b/src/wps/httpread.c
- index 2f08f37275c0..d2855e32fd0f 100644
- --- a/src/wps/httpread.c
- +++ b/src/wps/httpread.c
- @@ -533,6 +533,13 @@ static void httpread_read_handler(int sd, void *eloop_ctx, void *sock_ctx)
- if (!isxdigit(*cbp))
- goto bad;
- h->chunk_size = strtoul(cbp, NULL, 16);
- + if (h->chunk_size < 0 ||
- + h->chunk_size > h->max_bytes) {
- + wpa_printf(MSG_DEBUG,
- + "httpread: Invalid chunk size %d",
- + h->chunk_size);
- + goto bad;
- + }
- /* throw away chunk header
- * so we have only real data
- */
- --
- 2.1.4
|
