From 6216eb1494e2a7aff29dfb6c54c89e700ca43c84 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 10 Dec 2012 16:03:52 +0000
Subject: main/hostapd: fix CVE-2012-4445

fixes #1431
---
 main/hostapd/APKBUILD            | 11 +++++++++-
 main/hostapd/CVE-2012-4445.patch | 45 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+), 1 deletion(-)
 create mode 100644 main/hostapd/CVE-2012-4445.patch

diff --git a/main/hostapd/APKBUILD b/main/hostapd/APKBUILD
index cf8b875648a..8a4d8c5b7d6 100644
--- a/main/hostapd/APKBUILD
+++ b/main/hostapd/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=hostapd
 pkgver=0.7.3
-pkgrel=1
+pkgrel=2
 pkgdesc="daemon for wireless software access points"
 url="http://hostap.epitest.fi/hostapd/"
 arch="all"
@@ -10,7 +10,9 @@ depends=
 makedepends="openssl-dev libnl-dev"
 install=
 subpackages="$pkgname-doc"
+patches="CVE-2012-4445.patch"
 source="http://hostap.epitest.fi/releases/$pkgname-$pkgver.tar.gz
+	$patches
 	$pkgname.initd
 	$pkgname.confd"
 
@@ -20,6 +22,12 @@ _builddir="$srcdir"/$pkgname-$pkgver/hostapd
 prepare() {
 	local conf="$_builddir/.config"
 
+	cd "$_builddir"/..
+	for i in $patches; do
+		msg $i
+		patch -p1 -i "$srcdir"/$i || return 1
+	done
+
 	cd "$_builddir"
 	sed -i -e "s:/etc/hostapd:/etc/hostapd/hostapd:g" \
 		hostapd.conf
@@ -107,5 +115,6 @@ package() {
 }
 
 md5sums="91a7c8d0f090b7104152d3455a84c112  hostapd-0.7.3.tar.gz
+0d01d4641e0c33f79c1f4372613655bf  CVE-2012-4445.patch
 fdbc94a99eca18f51294b5a96136ffdf  hostapd.initd
 c91382209042defa04e79d0ae841a29e  hostapd.confd"
diff --git a/main/hostapd/CVE-2012-4445.patch b/main/hostapd/CVE-2012-4445.patch
new file mode 100644
index 00000000000..552307d279c
--- /dev/null
+++ b/main/hostapd/CVE-2012-4445.patch
@@ -0,0 +1,45 @@
+From: Jouni Malinen <j@w1.fi>
+Date: Sun, 7 Oct 2012 17:06:29 +0000 (+0300)
+Subject: EAP-TLS server: Fix TLS Message Length validation
+X-Git-Url: http://w1.fi/gitweb/gitweb.cgi?p=hostap.git;a=commitdiff_plain;h=586c446e0ff42ae00315b014924ec669023bd8de
+
+EAP-TLS server: Fix TLS Message Length validation
+
+EAP-TLS/PEAP/TTLS/FAST server implementation did not validate TLS
+Message Length value properly and could end up trying to store more
+information into the message buffer than the allocated size if the first
+fragment is longer than the indicated size. This could result in hostapd
+process terminating in wpabuf length validation. Fix this by rejecting
+messages that have invalid TLS Message Length value.
+
+This would affect cases that use the internal EAP authentication server
+in hostapd either directly with IEEE 802.1X or when using hostapd as a
+RADIUS authentication server and when receiving an incorrectly
+constructed EAP-TLS message. Cases where hostapd uses an external
+authentication are not affected.
+
+Thanks to Timo Warns for finding and reporting this issue.
+
+Signed-hostap: Jouni Malinen <j@w1.fi>
+intended-for: hostap-1
+---
+
+diff --git a/src/eap_server/eap_server_tls_common.c b/src/eap_server/eap_server_tls_common.c
+index 31be2ec..46f282b 100644
+--- a/src/eap_server/eap_server_tls_common.c
++++ b/src/eap_server/eap_server_tls_common.c
+@@ -228,6 +228,14 @@ static int eap_server_tls_process_fragment(struct eap_ssl_data *data,
+ 			return -1;
+ 		}
+ 
++		if (len > message_length) {
++			wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in "
++				   "first fragment of frame (TLS Message "
++				   "Length %d bytes)",
++				   (int) len, (int) message_length);
++			return -1;
++		}
++
+ 		data->tls_in = wpabuf_alloc(message_length);
+ 		if (data->tls_in == NULL) {
+ 			wpa_printf(MSG_DEBUG, "SSL: No memory for message");
-- 
cgit v1.2.3