denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

eap-ttls: Prevent crash if AVP length header field is invalid

Browse Source 
The length field in the AVP header includes the 8 bytes of the header
itself.  Not checking for that and later subtracting it causes an
integer underflow that usually triggers a crash when accessing a
NULL pointer that resulted from the failing chunk_alloc() call because
of the high value.

The attempted allocations for invalid lengths (0-7) are 0xfffffff8,
0xfffffffc, or 0x100000000 (0 on 32-bit hosts), so this doesn't result
in a buffer overflow even if the allocation succeeds.

Fixes: 79f2102cb4 ("implemented server side support for EAP-TTLS")
Fixes: CVE-2026-25075
This commit is contained in:
Tobias Brunner
2026-03-19 16:49:41 +01:00
parent 0fcece9fff
commit 73aff21077
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/eap_ttls/eap_ttls_avp.c
+2 -2
View File
@@ -119,7 +119,7 @@ METHOD(eap_ttls_avp_t, process, status_t,
chunk_free(&this->input); chunk_free(&this->input);
this->inpos = 0; this->inpos = 0;
if (!success) if (!success || avp_len < AVP_HEADER_LEN)
{ {
DBG1(DBG_IKE, "received invalid AVP header"); DBG1(DBG_IKE, "received invalid AVP header");
return FAILED; return FAILED;
@@ -130,7 +130,7 @@ METHOD(eap_ttls_avp_t, process, status_t,
return FAILED; return FAILED;
} }
this->process_header = FALSE; this->process_header = FALSE;
this->data_len = avp_len - 8; this->data_len = avp_len - AVP_HEADER_LEN;
this->input = chunk_alloc(this->data_len + (4 - avp_len) % 4); this->input = chunk_alloc(this->data_len + (4 - avp_len) % 4);
} }