diff options
| author | Jouni Malinen <jouni.malinen@atheros.com> | 2010-12-17 11:02:56 +0200 |
|---|---|---|
| committer | Jouni Malinen <j@w1.fi> | 2010-12-17 11:02:56 +0200 |
| commit | 71a7e936e12d950fbaf613022a060a9ae07750d1 (patch) | |
| tree | 18c0b38e60d90b6ef4a43a8c890cdb54926a7de2 /wlantest | |
| parent | 4d00fe48e3ce935cc04c668c0b0dfd3d94719f5a (diff) | |
| download | external_wpa_supplicant_8_ti-71a7e936e12d950fbaf613022a060a9ae07750d1.zip external_wpa_supplicant_8_ti-71a7e936e12d950fbaf613022a060a9ae07750d1.tar.gz external_wpa_supplicant_8_ti-71a7e936e12d950fbaf613022a060a9ae07750d1.tar.bz2 | |
wlantest: Fix buffer read overflow on CCMP encryption
The encryption code may write a full AES block to the end of the
buffer, so make sure the temporary buffer is long enough to fit that
data.
Diffstat (limited to 'wlantest')
| -rw-r--r-- | wlantest/ccmp.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/wlantest/ccmp.c b/wlantest/ccmp.c index 12add4d..c632e39 100644 --- a/wlantest/ccmp.c +++ b/wlantest/ccmp.c @@ -109,7 +109,7 @@ u8 * ccmp_decrypt(const u8 *tk, const struct ieee80211_hdr *hdr, if (data_len < 8 + 8) return NULL; - plain = os_malloc(data_len); + plain = os_malloc(data_len + AES_BLOCK_SIZE); if (plain == NULL) return NULL; @@ -241,7 +241,7 @@ u8 * ccmp_encrypt(const u8 *tk, u8 *frame, size_t len, size_t hdrlen, u8 *qos, plen = len - hdrlen; last = plen % AES_BLOCK_SIZE; - crypt = os_malloc(hdrlen + 8 + plen + 8); + crypt = os_malloc(hdrlen + 8 + plen + 8 + AES_BLOCK_SIZE); if (crypt == NULL) return NULL; |