diff options
| author | Mark H Weaver <mhw@netris.org> | 2015-05-11 12:46:31 -0400 |
|---|---|---|
| committer | Mark H Weaver <mhw@netris.org> | 2015-05-11 12:51:47 -0400 |
| commit | d48c8e7b6070a63dc12ead0bb9ea47b790e237f0 (patch) | |
| tree | addb863d86c362a9287f9277bdc65d79620ab306 /gnu/packages/patches/wpa-supplicant-2015-4-fix-pt5.patch | |
| parent | 1ec78e9d71d7c38c5739c90d3927e227bce23caa (diff) | |
| download | guix-d48c8e7b6070a63dc12ead0bb9ea47b790e237f0.tar guix-d48c8e7b6070a63dc12ead0bb9ea47b790e237f0.tar.gz | |
gnu: wpa-supplicant: Add security fixes.
* gnu/packages/patches/wpa-supplicant-2015-2-fix.patch,
gnu/packages/patches/wpa-supplicant-2015-3-fix.patch,
gnu/packages/patches/wpa-supplicant-2015-4-fix-pt1.patch,
gnu/packages/patches/wpa-supplicant-2015-4-fix-pt2.patch,
gnu/packages/patches/wpa-supplicant-2015-4-fix-pt3.patch,
gnu/packages/patches/wpa-supplicant-2015-4-fix-pt4.patch,
gnu/packages/patches/wpa-supplicant-2015-4-fix-pt5.patch: New files.
* gnu-system.am (dist_patch_DATA): Add them.
* gnu/packages/admin.scm (wpa-supplicant-light)[source]: Add patches.
Diffstat (limited to 'gnu/packages/patches/wpa-supplicant-2015-4-fix-pt5.patch')
| -rw-r--r-- | gnu/packages/patches/wpa-supplicant-2015-4-fix-pt5.patch | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/gnu/packages/patches/wpa-supplicant-2015-4-fix-pt5.patch b/gnu/packages/patches/wpa-supplicant-2015-4-fix-pt5.patch new file mode 100644 index 0000000000..30f71974ad --- /dev/null +++ b/gnu/packages/patches/wpa-supplicant-2015-4-fix-pt5.patch @@ -0,0 +1,34 @@ +Patch copied from http://w1.fi/security/2015-4/ + +From 28a069a545b06b99eb55ad53f63f2c99e65a98f6 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j@w1.fi> +Date: Sat, 2 May 2015 19:26:28 +0300 +Subject: [PATCH 5/5] EAP-pwd peer: Fix asymmetric fragmentation behavior + +The L (Length) and M (More) flags needs to be cleared before deciding +whether the locally generated response requires fragmentation. This +fixes an issue where these flags from the server could have been invalid +for the following message. In some cases, this could have resulted in +triggering the wpabuf security check that would terminate the process +due to invalid buffer allocation. + +Signed-off-by: Jouni Malinen <j@w1.fi> +--- + src/eap_peer/eap_pwd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c +index 1d2079b..e58b13a 100644 +--- a/src/eap_peer/eap_pwd.c ++++ b/src/eap_peer/eap_pwd.c +@@ -968,6 +968,7 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret, + /* + * we have output! Do we need to fragment it? + */ ++ lm_exch = EAP_PWD_GET_EXCHANGE(lm_exch); + len = wpabuf_len(data->outbuf); + if ((len + EAP_PWD_HDR_SIZE) > data->mtu) { + resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, data->mtu, +-- +1.9.1 + |