From f7835d0dcba27559b04f4f6faad26a7a19e3c3f0 Mon Sep 17 00:00:00 2001 From: Linus Nordberg Date: Fri, 16 Jan 2015 16:44:04 +0100 Subject: Fix heap overflow in raddtlsget(), radtcpget() and radtlsget(). MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Patch by Stephen Röttger. --- dtls.c | 4 ++++ tcp.c | 4 ++++ tls.c | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/dtls.c b/dtls.c index 2586b8f..8f8c90a 100644 --- a/dtls.c +++ b/dtls.c @@ -235,6 +235,10 @@ unsigned char *raddtlsget(SSL *ssl, struct gqueue *rbios, int timeout) { } len = RADLEN(buf); + if (len < 4) { + debug(DBG_ERR, "raddtlsget: length too small"); + continue; + } rad = malloc(len); if (!rad) { debug(DBG_ERR, "raddtlsget: malloc failed"); diff --git a/tcp.c b/tcp.c index 0ad574c..a2f8e7c 100644 --- a/tcp.c +++ b/tcp.c @@ -169,6 +169,10 @@ unsigned char *radtcpget(int s, int timeout) { } len = RADLEN(buf); + if (len < 4) { + debug(DBG_ERR, "radtcpget: length too small"); + continue; + } rad = malloc(len); if (!rad) { debug(DBG_ERR, "radtcpget: malloc failed"); diff --git a/tls.c b/tls.c index d376e73..d33fc1b 100644 --- a/tls.c +++ b/tls.c @@ -216,6 +216,10 @@ unsigned char *radtlsget(SSL *ssl, int timeout) { } len = RADLEN(buf); + if (len < 4) { + debug(DBG_ERR, "radtlsget: length too small"); + continue; + } rad = malloc(len); if (!rad) { debug(DBG_ERR, "radtlsget: malloc failed"); -- cgit v1.1