sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2026-10-07 15:05:42 +03:00
Code Issues Packages Projects Releases Wiki Activity

[eap] Verify header length for all EAP packet types

Browse Source 
The header length field exists for all packet types.  Validate this
length wihtin eap_rx() for all packet types, rather than performing
validation only for EAP requests in eap_rx_request().

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2026-07-30 16:58:52 +01:00
parent 48c04ec047
commit 18dd4483ce
1 changed files with 15 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/net/eap.c
+15 -8
View File
@@ -187,13 +187,8 @@ static int eap_rx_request ( struct eap_supplicant *supplicant,
DBGC_HDA ( netdev, 0, msg, len );
return -EINVAL;
}
if ( len < ntohs ( msg->hdr.len ) ) {
DBGC ( netdev, "EAP %s truncated request:\n", netdev->name );
DBGC_HDA ( netdev, 0, msg, len );
return -EINVAL;
}
req = msg->data;
req_len = ( ntohs ( msg->hdr.len ) - sizeof ( *msg ) );
req_len = ( len - sizeof ( *msg ) );
/* Record request details */
supplicant->id = msg->hdr.id;
@@ -265,18 +260,30 @@ int eap_rx ( struct eap_supplicant *supplicant, const void *data,
size_t len ) {
struct net_device *netdev = supplicant->netdev;
const union eap_packet *eap = data;
size_t msg_len;
/* Sanity check */
/* Sanity checks */
if ( len < sizeof ( eap->hdr ) ) {
DBGC ( netdev, "EAP %s underlength header:\n", netdev->name );
DBGC_HDA ( netdev, 0, eap, len );
return -EINVAL;
}
msg_len = ntohs ( eap->hdr.len );
if ( msg_len < sizeof ( eap->hdr ) ) {
DBGC ( netdev, "EAP %s underlength packet:\n", netdev->name );
DBGC_HDA ( netdev, 0, eap, len );
return -EINVAL;
}
if ( msg_len > len ) {
DBGC ( netdev, "EAP %s truncated packet:\n", netdev->name );
DBGC_HDA ( netdev, 0, eap, len );
return -EINVAL;
}
/* Handle according to code */
switch ( eap->hdr.code ) {
case EAP_CODE_REQUEST:
return eap_rx_request ( supplicant, &eap->msg, len );
return eap_rx_request ( supplicant, &eap->msg, msg_len );
case EAP_CODE_RESPONSE:
DBGC2 ( netdev, "EAP %s ignoring response\n", netdev->name );
return 0;