Package: freeradius / 3.0.12+dfsg-5+deb9u1

fr-gv-201.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
From fc8662d7e827f630d515eaa0bddfa94754c8047f Mon Sep 17 00:00:00 2001
From: "Alan T. DeKok" <aland@freeradius.org>
Date: Tue, 4 Jul 2017 10:12:09 -0400
Subject: [PATCH] FR-GV-201 - check input / output length in make_secret()

---
 src/lib/radius.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

Index: freeradius-3.0.12+dfsg/src/lib/radius.c
===================================================================
--- freeradius-3.0.12+dfsg.orig/src/lib/radius.c
+++ freeradius-3.0.12+dfsg/src/lib/radius.c
@@ -542,17 +542,17 @@ static ssize_t rad_recvfrom(int sockfd,
  * encrypting passwords to RADIUS.
  */
 static void make_secret(uint8_t *digest, uint8_t const *vector,
-			char const *secret, uint8_t const *value)
+			char const *secret, uint8_t const *value, size_t length)
 {
 	FR_MD5_CTX context;
-	int	     i;
+	size_t	     i;
 
 	fr_md5_init(&context);
 	fr_md5_update(&context, vector, AUTH_VECTOR_LEN);
 	fr_md5_update(&context, (uint8_t const *) secret, strlen(secret));
 	fr_md5_final(digest, &context);
 
-	for ( i = 0; i < AUTH_VECTOR_LEN; i++ ) {
+	for ( i = 0; i < length; i++ ) {
 		digest[i] ^= value[i];
 	}
 }
@@ -1010,8 +1010,8 @@ static ssize_t vp2data_any(RADIUS_PACKET
 		 *	always fits.
 		 */
 	case FLAG_ENCRYPT_ASCEND_SECRET:
-		if (len != 16) return 0;
-		make_secret(ptr, packet->vector, secret, data);
+		if (len > AUTH_VECTOR_LEN) len = AUTH_VECTOR_LEN;
+		make_secret(ptr, packet->vector, secret, data, len);
 		len = AUTH_VECTOR_LEN;
 		break;
 
@@ -3587,9 +3587,14 @@ ssize_t data2vp(TALLOC_CTX *ctx,
 				goto raw;
 			} else {
 				uint8_t my_digest[AUTH_VECTOR_LEN];
+				size_t secret_len;
+
+				secret_len = datalen;
+				if (secret_len > AUTH_VECTOR_LEN) secret_len = AUTH_VECTOR_LEN;
+
 				make_secret(my_digest,
 					    original->vector,
-					    secret, data);
+					    secret, data, secret_len);
 				memcpy(buffer, my_digest,
 				       AUTH_VECTOR_LEN );
 				buffer[AUTH_VECTOR_LEN] = '\0';