1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
From 38ee90f2a5a28dc5887a30bdfdc98109c0418e68 Mon Sep 17 00:00:00 2001
From: "Alan T. DeKok" <aland@freeradius.org>
Date: Mon, 3 Jul 2017 22:04:40 -0400
Subject: [PATCH] FR-GV-201 - check input / output length in make_secret()
---
src/lib/radius.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
Index: freeradius-2.2.5+dfsg/src/lib/radius.c
===================================================================
--- freeradius-2.2.5+dfsg.orig/src/lib/radius.c
+++ freeradius-2.2.5+dfsg/src/lib/radius.c
@@ -480,7 +480,7 @@ static ssize_t rad_recvfrom(int sockfd,
*
*************************************************************************/
static void make_secret(uint8_t *digest, const uint8_t *vector,
- const char *secret, const uint8_t *value)
+ const char *secret, const uint8_t *value, size_t length)
{
FR_MD5_CTX context;
int i;
@@ -490,7 +490,7 @@ static void make_secret(uint8_t *digest,
fr_MD5Update(&context, (const uint8_t *) secret, strlen(secret));
fr_MD5Final(digest, &context);
- for ( i = 0; i < AUTH_VECTOR_LEN; i++ ) {
+ for ( i = 0; i < length; i++ ) {
digest[i] ^= value[i];
}
}
@@ -785,9 +785,8 @@ static uint8_t *vp2data(const RADIUS_PAC
#ifndef NDEBUG
if (data == array) return NULL;
#endif
- if (len != AUTH_VECTOR_LEN) return NULL;
- make_secret(ptr, packet->vector, secret, data);
- len = AUTH_VECTOR_LEN;
+ if (len > AUTH_VECTOR_LEN) len = AUTH_VECTOR_LEN;
+ make_secret(ptr, packet->vector, secret, data, len);
break;
@@ -2311,9 +2310,14 @@ static VALUE_PAIR *data2vp(const RADIUS_
goto raw;
} else {
uint8_t my_digest[AUTH_VECTOR_LEN];
+ size_t secret_len;
+
+ secret_len = length;
+ if (secret_len > AUTH_VECTOR_LEN) secret_len = AUTH_VECTOR_LEN;
+
make_secret(my_digest,
original->vector,
- secret, data);
+ secret, data, secret_len);
memcpy(vp->vp_strvalue, my_digest,
AUTH_VECTOR_LEN );
vp->vp_strvalue[AUTH_VECTOR_LEN] = '\0';
|
