Author: cperciva
Date: Fri Nov 23 01:48:31 2012
New Revision: 243419
URL: http://svnweb.freebsd.org/changeset/base/243419
Log:
MFS security patches which seem to have accidentally not reached HEAD:
Fix insufficient message length validation for EAP-TLS messages.
Fix Linux compatibility layer input validation error.
Security: FreeBSD-SA-12:07.hostapd
Security: FreeBSD-SA-12:08.linux
Security: CVE-2012-4445, CVE-2012-4576
With hat: so@
Modified:
head/contrib/wpa/src/eap_server/eap_server_tls_common.c
head/sys/compat/linux/linux_ioctl.c
Modified: head/contrib/wpa/src/eap_server/eap_server_tls_common.c
==============================================================================
--- head/contrib/wpa/src/eap_server/eap_server_tls_common.c Thu Nov 22
23:15:38 2012 (r243418)
+++ head/contrib/wpa/src/eap_server/eap_server_tls_common.c Fri Nov 23
01:48:31 2012 (r243419)
@@ -225,6 +225,14 @@ static int eap_server_tls_process_fragme
return -1;
}
+ if (len > message_length) {
+ wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in "
+ "first fragment of frame (TLS Message "
+ "Length %d bytes)",
+ (int) len, (int) message_length);
+ return -1;
+ }
+
data->tls_in = wpabuf_alloc(message_length);
if (data->tls_in == NULL) {
wpa_printf(MSG_DEBUG, "SSL: No memory for message");
Modified: head/sys/compat/linux/linux_ioctl.c
==============================================================================
--- head/sys/compat/linux/linux_ioctl.c Thu Nov 22 23:15:38 2012
(r243418)
+++ head/sys/compat/linux/linux_ioctl.c Fri Nov 23 01:48:31 2012
(r243419)
@@ -2260,8 +2260,9 @@ again:
ifc.ifc_len = valid_len;
sbuf_finish(sb);
- memcpy(PTRIN(ifc.ifc_buf), sbuf_data(sb), ifc.ifc_len);
- error = copyout(&ifc, uifc, sizeof(ifc));
+ error = copyout(sbuf_data(sb), PTRIN(ifc.ifc_buf), ifc.ifc_len);
+ if (error == 0)
+ error = copyout(&ifc, uifc, sizeof(ifc));
sbuf_delete(sb);
CURVNET_RESTORE();
_______________________________________________
svn-src-head@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
