hostapd: merge a security fix for a TLS message buffer overflow (CVE-2012-4445)

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@33815 3c298f89-4303-0410-b956-a3cf2f4a3e73

diff --git a/package/network/services/hostapd/patches/001-CVE-2012-4445.patch b/package/network/services/hostapd/patches/001-CVE-2012-4445.patch
new file mode 100644 (file)
index 0000000..1b8bdd0
--- /dev/null
+++ b/package/network/services/hostapd/patches/001-CVE-2012-4445.patch
@@ -0,0 +1,17 @@
+--- a/src/eap_server/eap_server_tls_common.c
++++ b/src/eap_server/eap_server_tls_common.c
+@@ -228,6 +228,14 @@ static int eap_server_tls_process_fragme
+                       return -1;
+               }
+ 
++              if (len > message_length) {
++                      wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in "
++                                 "first fragment of frame (TLS Message "
++                                 "Length %d bytes)",
++                                 (int) len, (int) message_length);
++                      return -1;
++              }
++
+               data->tls_in = wpabuf_alloc(message_length);
+               if (data->tls_in == NULL) {
+                       wpa_printf(MSG_DEBUG, "SSL: No memory for message");