From 26944502e3ac3625b25a2911894bcdd252e39b30 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@openwrt.org>
Date: Wed, 17 Oct 2012 18:16:56 +0000
Subject: [PATCH] hostapd: merge a security fix for a TLS message buffer
 overflow (CVE-2012-4445)

SVN-Revision: 33815
---
 .../hostapd/patches/001-CVE-2012-4445.patch     | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 package/network/services/hostapd/patches/001-CVE-2012-4445.patch

diff --git a/package/network/services/hostapd/patches/001-CVE-2012-4445.patch b/package/network/services/hostapd/patches/001-CVE-2012-4445.patch
new file mode 100644
index 0000000000..1b8bdd00c5
--- /dev/null
+++ b/package/network/services/hostapd/patches/001-CVE-2012-4445.patch
@@ -0,0 +1,17 @@
+--- a/src/eap_server/eap_server_tls_common.c
++++ b/src/eap_server/eap_server_tls_common.c
+@@ -228,6 +228,14 @@ static int eap_server_tls_process_fragme
+ 			return -1;
+ 		}
+ 
++		if (len > message_length) {
++			wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in "
++				   "first fragment of frame (TLS Message "
++				   "Length %d bytes)",
++				   (int) len, (int) message_length);
++			return -1;
++		}
++
+ 		data->tls_in = wpabuf_alloc(message_length);
+ 		if (data->tls_in == NULL) {
+ 			wpa_printf(MSG_DEBUG, "SSL: No memory for message");
-- 
2.30.2