diff options
Diffstat (limited to 'net/hostapd/files/patch-src_wps_httpread.c')
| -rw-r--r-- | net/hostapd/files/patch-src_wps_httpread.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/net/hostapd/files/patch-src_wps_httpread.c b/net/hostapd/files/patch-src_wps_httpread.c new file mode 100644 index 000000000000..dfdc89f2a8cd --- /dev/null +++ b/net/hostapd/files/patch-src_wps_httpread.c @@ -0,0 +1,16 @@ +--- src/wps/httpread.c.orig 2015-03-15 17:30:39 UTC ++++ src/wps/httpread.c +@@ -533,6 +533,13 @@ static void httpread_read_handler(int sd + if (!isxdigit(*cbp)) + goto bad; + h->chunk_size = strtoul(cbp, NULL, 16); ++ if (h->chunk_size < 0 || ++ h->chunk_size > h->max_bytes) { ++ wpa_printf(MSG_DEBUG, ++ "httpread: Invalid chunk size %d", ++ h->chunk_size); ++ goto bad; ++ } + /* throw away chunk header + * so we have only real data + */ |