A malicious (authenticated) server could send a long AT_NEXT_PSEUDONYM
or AT_NEXT_REAUTH_ID attribute (max. 1016 bytes) that the client then
attempts to return in an AT_IDENTITY attribute that could overflow the
fixed-sized stack buffer `out_buf` by a few bytes (writing into the
`encr_buf` buffer).
This refactoring first calculates the length required to encode the
attributes (with and without encryption) and accounts for the overhead
necessary for AT_ENCR_DATA, AT_PADDING, and AT_MAC (some limits are
enforced and error handling is added where appropriate). Then correctly
sized buffers are allocated and the attributes are encoded pretty much
as before. Except that the encoding of AT_RES is corrected (it actually
worked fine for up to 31 bytes, so in practice it wasn't a problem),
AT_PADDING is not added if data is already block-aligned, and it corrects
handling of AT_NOTIFICATION (they are never sent encrypted according to
the RFCs, but protected with a MAC).
Fixes: f8330d0395 ("Added a libsimaka library with shared message handling code for EAP-SIM/AKA")
parse_attributes() accepts hdr->length == 0 in the AT_ENCR_DATA,
AT_RAND, AT_PADDING, default branches. The code then subtracts the
fixed attribute header size from the encoded length, which underflows
and exposes a wrapped payload length to later code. In particular,
for the cases where add_attribute() is called, this causes a heap-based
buffer overflow (a buffer of 12 bytes is allocated to which the wrapped
length is written). For AT_PADDING, the underflow is irrelevant as
add_attribute() is not called. Instead, this results in an infinite loop.
Reject zero-length attributes before subtracting the attribute header.
Signed-off-by: Lukas Johannes Möller <[email protected]>
Fixes: f8330d0395 ("Added a libsimaka library with shared message handling code for EAP-SIM/AKA")
Fixes: CVE-2026-35330
These attributes contain a 16-bit length field for the actual length of
the data in bits or bytes, as compared to the length in 4-byte blocks in
the attribute header. The previous code didn't correctly account for the
length of the fixed header (4 bytes) when it compared the parsed length
to the length in the header. This could cause an out-of-bounds read of
up to four bytes beyond the end of the attribute/message.
Fixes: f8330d0395 ("Added a libsimaka library with shared message handling code for EAP-SIM/AKA")
The flag is required to convince libtool on Cygwin to build DLLs. But on
Windows these shared libraries can not have undefined symbols, so we have to
link them explicitly to the libraries they reference.
For plugins this is currently not done, so only the monolithic build is
supported. The plugin loader wouldn't be able to load DLLs anyway, as
it tries to load files that don't exist on Cygwin.
INCLUDES are now deprecated and throw warnings when using automake 1.13.
We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and
defines are passed to AM_CPPFLAGS only.
Warnings like
comparison of unsigned expression < 0 is always false
are reported with -Wextra when enum types that are compiled to an
unsigned type (which is up to the compiler) are checked for negativity.
Tobias Brunner