security/wpa_supplicant: Address 3 latest security advisories

These are combined upstream patches 2015-2, 2015-3, 2015-4
They address the following security advisories:

  * CVE-2015-4141
  * CVE-2015-4142
  * CVE-2015-4143
  * CVE-2015-4144
  * CVE-2015-4145
  * CVE-2015-4146

These advisories also apply to net/hostapd

PR:		200568
Submitted by:	Jason Unovitch

5 files changed, 166 insertions, 1 deletions

diff --git a/security/wpa_supplicant/Makefile b/security/wpa_supplicant/Makefile
index 8c7c1618bb52..4a98e66cf4a1 100644
--- a/security/wpa_supplicant/Makefile
+++ b/security/wpa_supplicant/Makefile
@@ -2,7 +2,7 @@
 
 PORTNAME=	wpa_supplicant
 PORTVERSION=	2.4
-PORTREVISION=	2
+PORTREVISION=	3
 CATEGORIES=	security net
 MASTER_SITES=	http://w1.fi/releases/
 
diff --git a/security/wpa_supplicant/files/patch-src_ap_wmm.c b/security/wpa_supplicant/files/patch-src_ap_wmm.c
new file mode 100644
index 000000000000..3da758573de3
--- /dev/null
+++ b/security/wpa_supplicant/files/patch-src_ap_wmm.c
@@ -0,0 +1,12 @@
+--- src/ap/wmm.c.orig	2015-03-15 17:30:39 UTC
++++ src/ap/wmm.c
+@@ -274,6 +274,9 @@ void hostapd_wmm_action(struct hostapd_d
+ 		return;
+ 	}
+ 
++	if (left < 0)
++		return; /* not a valid WMM Action frame */
++
+ 	/* extract the tspec info element */
+ 	if (ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed) {
+ 		hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
diff --git a/security/wpa_supplicant/files/patch-src_eap__peer_eap__pwd.c b/security/wpa_supplicant/files/patch-src_eap__peer_eap__pwd.c
new file mode 100644
index 000000000000..e3910df59c0b
--- /dev/null
+++ b/security/wpa_supplicant/files/patch-src_eap__peer_eap__pwd.c
@@ -0,0 +1,77 @@
+--- src/eap_peer/eap_pwd.c.orig	2015-03-15 17:30:39 UTC
++++ src/eap_peer/eap_pwd.c
+@@ -301,6 +301,23 @@ eap_pwd_perform_commit_exchange(struct e
+ 	BIGNUM *mask = NULL, *x = NULL, *y = NULL, *cofactor = NULL;
+ 	u16 offset;
+ 	u8 *ptr, *scalar = NULL, *element = NULL;
++	size_t prime_len, order_len;
++
++	if (data->state != PWD_Commit_Req) {
++		ret->ignore = TRUE;
++		goto fin;
++	}
++
++	prime_len = BN_num_bytes(data->grp->prime);
++	order_len = BN_num_bytes(data->grp->order);
++
++	if (payload_len != 2 * prime_len + order_len) {
++		wpa_printf(MSG_INFO,
++			   "EAP-pwd: Unexpected Commit payload length %u (expected %u)",
++			   (unsigned int) payload_len,
++			   (unsigned int) (2 * prime_len + order_len));
++		goto fin;
++	}
+ 
+ 	if (((data->private_value = BN_new()) == NULL) ||
+ 	    ((data->my_element = EC_POINT_new(data->grp->group)) == NULL) ||
+@@ -500,6 +517,18 @@ eap_pwd_perform_confirm_exchange(struct 
+ 	u8 conf[SHA256_MAC_LEN], *cruft = NULL, *ptr;
+ 	int offset;
+ 
++	if (data->state != PWD_Confirm_Req) {
++		ret->ignore = TRUE;
++		goto fin;
++	}
++
++	if (payload_len != SHA256_MAC_LEN) {
++		wpa_printf(MSG_INFO,
++			   "EAP-pwd: Unexpected Confirm payload length %u (expected %u)",
++			   (unsigned int) payload_len, SHA256_MAC_LEN);
++		goto fin;
++	}
++
+ 	/*
+ 	 * first build up the ciphersuite which is group | random_function |
+ 	 *	prf
+@@ -783,11 +812,23 @@ eap_pwd_process(struct eap_sm *sm, void 
+ 	 * if it's the first fragment there'll be a length field
+ 	 */
+ 	if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) {
++		if (len < 2) {
++			wpa_printf(MSG_DEBUG,
++				   "EAP-pwd: Frame too short to contain Total-Length field");
++			ret->ignore = TRUE;
++			return NULL;
++		}
+ 		tot_len = WPA_GET_BE16(pos);
+ 		wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments whose "
+ 			   "total length = %d", tot_len);
+ 		if (tot_len > 15000)
+ 			return NULL;
++		if (data->inbuf) {
++			wpa_printf(MSG_DEBUG,
++				   "EAP-pwd: Unexpected new fragment start when previous fragment is still in use");
++			ret->ignore = TRUE;
++			return NULL;
++		}
+ 		data->inbuf = wpabuf_alloc(tot_len);
+ 		if (data->inbuf == NULL) {
+ 			wpa_printf(MSG_INFO, "Out of memory to buffer "
+@@ -873,6 +914,7 @@ eap_pwd_process(struct eap_sm *sm, void 
+ 	/*
+ 	 * we have output! Do we need to fragment it?
+ 	 */
++	lm_exch = EAP_PWD_GET_EXCHANGE(lm_exch);
+ 	len = wpabuf_len(data->outbuf);
+ 	if ((len + EAP_PWD_HDR_SIZE) > data->mtu) {
+ 		resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, data->mtu,
diff --git a/security/wpa_supplicant/files/patch-src_eap__server_eap__server__pwd.c b/security/wpa_supplicant/files/patch-src_eap__server_eap__server__pwd.c
new file mode 100644
index 000000000000..ddc2b99c766d
--- /dev/null
+++ b/security/wpa_supplicant/files/patch-src_eap__server_eap__server__pwd.c
@@ -0,0 +1,60 @@
+--- src/eap_server/eap_server_pwd.c.orig	2015-03-15 17:30:39 UTC
++++ src/eap_server/eap_server_pwd.c
+@@ -634,9 +634,21 @@ eap_pwd_process_commit_resp(struct eap_s
+ 	BIGNUM *x = NULL, *y = NULL, *cofactor = NULL;
+ 	EC_POINT *K = NULL, *point = NULL;
+ 	int res = 0;
++	size_t prime_len, order_len;
+ 
+ 	wpa_printf(MSG_DEBUG, "EAP-pwd: Received commit response");
+ 
++	prime_len = BN_num_bytes(data->grp->prime);
++	order_len = BN_num_bytes(data->grp->order);
++
++	if (payload_len != 2 * prime_len + order_len) {
++		wpa_printf(MSG_INFO,
++			   "EAP-pwd: Unexpected Commit payload length %u (expected %u)",
++			   (unsigned int) payload_len,
++			   (unsigned int) (2 * prime_len + order_len));
++		goto fin;
++	}
++
+ 	if (((data->peer_scalar = BN_new()) == NULL) ||
+ 	    ((data->k = BN_new()) == NULL) ||
+ 	    ((cofactor = BN_new()) == NULL) ||
+@@ -752,6 +764,13 @@ eap_pwd_process_confirm_resp(struct eap_
+ 	u8 conf[SHA256_MAC_LEN], *cruft = NULL, *ptr;
+ 	int offset;
+ 
++	if (payload_len != SHA256_MAC_LEN) {
++		wpa_printf(MSG_INFO,
++			   "EAP-pwd: Unexpected Confirm payload length %u (expected %u)",
++			   (unsigned int) payload_len, SHA256_MAC_LEN);
++		goto fin;
++	}
++
+ 	/* build up the ciphersuite: group | random_function | prf */
+ 	grp = htons(data->group_num);
+ 	ptr = (u8 *) &cs;
+@@ -901,11 +920,21 @@ static void eap_pwd_process(struct eap_s
+ 	 * the first fragment has a total length
+ 	 */
+ 	if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) {
++		if (len < 2) {
++			wpa_printf(MSG_DEBUG,
++				   "EAP-pwd: Frame too short to contain Total-Length field");
++			return;
++		}
+ 		tot_len = WPA_GET_BE16(pos);
+ 		wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments, total "
+ 			   "length = %d", tot_len);
+ 		if (tot_len > 15000)
+ 			return;
++		if (data->inbuf) {
++			wpa_printf(MSG_DEBUG,
++				   "EAP-pwd: Unexpected new fragment start when previous fragment is still in use");
++			return;
++		}
+ 		data->inbuf = wpabuf_alloc(tot_len);
+ 		if (data->inbuf == NULL) {
+ 			wpa_printf(MSG_INFO, "EAP-pwd: Out of memory to "
diff --git a/security/wpa_supplicant/files/patch-src_wps_httpread.c b/security/wpa_supplicant/files/patch-src_wps_httpread.c
new file mode 100644
index 000000000000..dfdc89f2a8cd
--- /dev/null
+++ b/security/wpa_supplicant/files/patch-src_wps_httpread.c
@@ -0,0 +1,16 @@
+--- src/wps/httpread.c.orig	2015-03-15 17:30:39 UTC
++++ src/wps/httpread.c
+@@ -533,6 +533,13 @@ static void httpread_read_handler(int sd
+ 					if (!isxdigit(*cbp))
+ 						goto bad;
+ 					h->chunk_size = strtoul(cbp, NULL, 16);
++					if (h->chunk_size < 0 ||
++					    h->chunk_size > h->max_bytes) {
++						wpa_printf(MSG_DEBUG,
++							   "httpread: Invalid chunk size %d",
++							   h->chunk_size);
++						goto bad;
++					}
+ 					/* throw away chunk header
+ 					 * so we have only real data
+ 					 */