From 4bcfa21ca4a87012661149c6b1b220578ebbe0f6 Mon Sep 17 00:00:00 2001 From: James Prestwood Date: Fri, 30 Jul 2021 08:07:26 -0700 Subject: [PATCH] eap-aka: round to nearest word on message buffers One of these message buffers was overflowing due to padding not being taken into account (caught by sanitizers). Wrapped the length of all message buffers with EAP_SIM_ROUND as to account for any padding that attributes may add. --- src/eap-aka.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/eap-aka.c b/src/eap-aka.c index 3ac0b662..9b693875 100644 --- a/src/eap-aka.c +++ b/src/eap-aka.c @@ -189,7 +189,7 @@ static void check_milenage_cb(const uint8_t *res, const uint8_t *ck, struct eap_aka_handle *aka = eap_get_data(eap); size_t resp_len = aka->protected ? 44 : 40; - uint8_t response[resp_len + 4]; + uint8_t response[EAP_SIM_ROUND(resp_len + 4)]; uint8_t *pos = response; if (auts) { @@ -512,7 +512,7 @@ static void handle_notification(struct eap_state *eap, const uint8_t *pkt, if (value == EAP_SIM_SUCCESS && aka->protected && aka->state == EAP_AKA_STATE_CHALLENGE) { /* header + MAC + MAC header */ - uint8_t response[8 + EAP_SIM_MAC_LEN + 4]; + uint8_t response[EAP_SIM_ROUND(8 + EAP_SIM_MAC_LEN + 4)]; uint8_t *pos = response; /* @@ -564,7 +564,7 @@ static void handle_identity(struct eap_state *eap, const uint8_t *pkt, size_t len) { struct eap_aka_handle *aka = eap_get_data(eap); - uint8_t response[8 + strlen(aka->identity) + 4]; + uint8_t response[EAP_SIM_ROUND(8 + strlen(aka->identity) + 4)]; uint8_t *pos = response; if (aka->state != EAP_AKA_STATE_UNCONNECTED) {