From 3e24c71ddcfd52e065bb01a489b5db71a42e1e54 Mon Sep 17 00:00:00 2001 From: Github Security Lab Date: Sat, 7 Mar 2020 23:03:40 +0100 Subject: [PATCH] `vallen` is verified to be less than `len`, therefore, it can never be the case that `vallen >= len + sizeof(rhostname)`. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR fixes the check so the `rhostname` array does not overflow. Reported-by: Github Security Lab Signed-off-by: Alvaro Muñoz --- .../network/tcpip/lwip_socket/lwip-2.0.3/src/netif/ppp/eap.c | 4 ++-- .../os/novaos/components/lwip/lwip-2.1.2/src/netif/ppp/eap.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/iot_link/network/tcpip/lwip_socket/lwip-2.0.3/src/netif/ppp/eap.c b/iot_link/network/tcpip/lwip_socket/lwip-2.0.3/src/netif/ppp/eap.c index 4134822fb..e26fe97df 100644 --- a/iot_link/network/tcpip/lwip_socket/lwip-2.0.3/src/netif/ppp/eap.c +++ b/iot_link/network/tcpip/lwip_socket/lwip-2.0.3/src/netif/ppp/eap.c @@ -1417,7 +1417,7 @@ static void eap_request(ppp_pcb *pcb, u_char *inp, int id, int len) { } /* Not so likely to happen. */ - if (vallen >= len + sizeof (rhostname)) { + if (len - vallen >= sizeof (rhostname)) { ppp_dbglog("EAP: trimming really long peer name down"); MEMCPY(rhostname, inp + vallen, sizeof (rhostname) - 1); rhostname[sizeof (rhostname) - 1] = '\0'; @@ -1845,7 +1845,7 @@ static void eap_response(ppp_pcb *pcb, u_char *inp, int id, int len) { } /* Not so likely to happen. */ - if (vallen >= len + sizeof (rhostname)) { + if (len - vallen >= sizeof (rhostname)) { ppp_dbglog("EAP: trimming really long peer name down"); MEMCPY(rhostname, inp + vallen, sizeof (rhostname) - 1); rhostname[sizeof (rhostname) - 1] = '\0'; diff --git a/iot_link/os/novaos/components/lwip/lwip-2.1.2/src/netif/ppp/eap.c b/iot_link/os/novaos/components/lwip/lwip-2.1.2/src/netif/ppp/eap.c index 5000e26b0..98e076225 100644 --- a/iot_link/os/novaos/components/lwip/lwip-2.1.2/src/netif/ppp/eap.c +++ b/iot_link/os/novaos/components/lwip/lwip-2.1.2/src/netif/ppp/eap.c @@ -1417,7 +1417,7 @@ static void eap_request(ppp_pcb *pcb, u_char *inp, int id, int len) { } /* Not so likely to happen. */ - if (vallen >= len + sizeof (rhostname)) { + if (len - vallen >= sizeof (rhostname)) { ppp_dbglog("EAP: trimming really long peer name down"); MEMCPY(rhostname, inp + vallen, sizeof (rhostname) - 1); rhostname[sizeof (rhostname) - 1] = '\0'; @@ -1845,7 +1845,7 @@ static void eap_response(ppp_pcb *pcb, u_char *inp, int id, int len) { } /* Not so likely to happen. */ - if (vallen >= len + sizeof (rhostname)) { + if (len - vallen >= sizeof (rhostname)) { ppp_dbglog("EAP: trimming really long peer name down"); MEMCPY(rhostname, inp + vallen, sizeof (rhostname) - 1); rhostname[sizeof (rhostname) - 1] = '\0';