hostapd: backport fix for CVE-2015-1863, refresh patches

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 45567
This commit is contained in:
Felix Fietkau 2015-04-23 08:01:51 +00:00
parent 7e3272f422
commit eba659cbba
5 changed files with 42 additions and 5 deletions

View File

@ -0,0 +1,37 @@
From 9ed4eee345f85e3025c33c6e20aa25696e341ccd Mon Sep 17 00:00:00 2001
From: Jouni Malinen <jouni@qca.qualcomm.com>
Date: Tue, 7 Apr 2015 11:32:11 +0300
Subject: [PATCH] P2P: Validate SSID element length before copying it
(CVE-2015-1863)
This fixes a possible memcpy overflow for P2P dev->oper_ssid in
p2p_add_device(). The length provided by the peer device (0..255 bytes)
was used without proper bounds checking and that could have resulted in
arbitrary data of up to 223 bytes being written beyond the end of the
dev->oper_ssid[] array (of which about 150 bytes would be beyond the
heap allocation) when processing a corrupted management frame for P2P
peer discovery purposes.
This could result in corrupted state in heap, unexpected program
behavior due to corrupted P2P peer device information, denial of service
due to process crash, exposure of memory contents during GO Negotiation,
and potentially arbitrary code execution.
Thanks to Google security team for reporting this issue and smart
hardware research group of Alibaba security team for discovering it.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
---
src/p2p/p2p.c | 1 +
1 file changed, 1 insertion(+)
--- a/src/p2p/p2p.c
+++ b/src/p2p/p2p.c
@@ -778,6 +778,7 @@ int p2p_add_device(struct p2p_data *p2p,
if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0)
os_memcpy(dev->interface_addr, addr, ETH_ALEN);
if (msg.ssid &&
+ msg.ssid[1] <= sizeof(dev->oper_ssid) &&
(msg.ssid[1] != P2P_WILDCARD_SSID_LEN ||
os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN)
!= 0)) {

View File

@ -8,7 +8,7 @@
#ifdef ANDROID
#include <sys/capability.h>
@@ -155,59 +156,46 @@ int os_gmtime(os_time_t t, struct os_tm
@@ -155,59 +156,46 @@ int os_gmtime(os_time_t t, struct os_tm
return 0;
}
@ -66,8 +66,8 @@
-#else /* __APPLE__ */
-#define os_daemon daemon
-#endif /* __APPLE__ */
-
-
-int os_daemonize(const char *pid_file)
-{
-#if defined(__uClinux__) || defined(__sun__)

View File

@ -157,7 +157,7 @@
#include "drivers/driver.h"
#include "wpa_supplicant_i.h"
#include "config.h"
@@ -277,6 +278,10 @@ static void calculate_update_time(const
@@ -277,6 +278,10 @@ static void calculate_update_time(const
static void wpa_bss_copy_res(struct wpa_bss *dst, struct wpa_scan_res *src,
struct os_reltime *fetch_time)
{

View File

@ -166,7 +166,7 @@
/**
* wpa_hexdump_ascii_key - conditional hex dump, hide keys
@@ -144,8 +179,14 @@ void wpa_hexdump_ascii(int level, const
@@ -144,8 +179,14 @@ void wpa_hexdump_ascii(int level, const
* bytes per line will be shown. This works like wpa_hexdump_ascii(), but by
* default, does not include secret keys (passwords, etc.) in debug output.
*/

View File

@ -33,7 +33,7 @@
/* Initialize the driver interface */
if (!(b[0] | b[1] | b[2] | b[3] | b[4] | b[5]))
b = NULL;
@@ -381,8 +393,6 @@ static void hostapd_global_deinit(const
@@ -381,8 +393,6 @@ static void hostapd_global_deinit(const
#endif /* CONFIG_NATIVE_WINDOWS */
eap_server_unregister_methods();