{"push_id":672860641,"size":8,"distinct_size":8,"ref":"refs/heads/cm-12.1","head":"b252e871c176d499b19015f4028b685f2943fa13","before":"55902a161e932be02f594f719da145a3d1610213","commits":[{"sha":"8c7552b0d7143fdbd9afa83cd582d56fed4ec091","author":{"email":"5c2dd944dde9e08881bef0894fe7b22a5c9c4b06@w1.fi","name":"Jouni Malinen"},"message":"EAP-pwd peer: Fix payload length validation for Commit and Confirm\n\nThe length of the received Commit and Confirm message payloads was not\nchecked before reading them. This could result in a buffer read\noverflow when processing an invalid message.\n\nFix this by verifying that the payload is of expected length before\nprocessing it. In addition, enforce correct state transition sequence to\nmake sure there is no unexpected behavior if receiving a Commit/Confirm\nmessage before the previous exchanges have been completed.\n\nThanks to Kostya Kortchinsky of Google security team for discovering and\nreporting this issue.\n\nChange-Id: Id2bc93879b12ffcd94b1ecdc98fc6c5f730d7027\nSigned-off-by: Jouni Malinen <j@w1.fi>","distinct":true,"url":"https://api.github.com/repos/temasek/android_external_wpa_supplicant_8/commits/8c7552b0d7143fdbd9afa83cd582d56fed4ec091"},{"sha":"c9a4555d84a8dbcfc7939832f75ed3654a72da80","author":{"email":"5c2dd944dde9e08881bef0894fe7b22a5c9c4b06@w1.fi","name":"Jouni Malinen"},"message":"EAP-pwd server: Fix payload length validation for Commit and Confirm\n\nThe length of the received Commit and Confirm message payloads was not\nchecked before reading them. This could result in a buffer read\noverflow when processing an invalid message.\n\nFix this by verifying that the payload is of expected length before\nprocessing it. In addition, enforce correct state transition sequence to\nmake sure there is no unexpected behavior if receiving a Commit/Confirm\nmessage before the previous exchanges have been completed.\n\nThanks to Kostya Kortchinsky of Google security team for discovering and\nreporting this issue.\n\nChange-Id: I5688a52eb08bbfe11dd0b82c63e540c43091ca18\nSigned-off-by: Jouni Malinen <j@w1.fi>","distinct":true,"url":"https://api.github.com/repos/temasek/android_external_wpa_supplicant_8/commits/c9a4555d84a8dbcfc7939832f75ed3654a72da80"},{"sha":"f24da54fee7e3cb0ba28fbb69d56055d310afb53","author":{"email":"5c2dd944dde9e08881bef0894fe7b22a5c9c4b06@w1.fi","name":"Jouni Malinen"},"message":"EAP-pwd peer: Fix Total-Length parsing for fragment reassembly\n\nThe remaining number of bytes in the message could be smaller than the\nTotal-Length field size, so the length needs to be explicitly checked\nprior to reading the field and decrementing the len variable. This could\nhave resulted in the remaining length becoming negative and interpreted\nas a huge positive integer.\n\nIn addition, check that there is no already started fragment in progress\nbefore allocating a new buffer for reassembling fragments. This avoid a\npotential memory leak when processing invalid message.\n\nChange-Id: Iff93a6434df546f093eb192e999e82f999abb96e\nSigned-off-by: Jouni Malinen <j@w1.fi>","distinct":true,"url":"https://api.github.com/repos/temasek/android_external_wpa_supplicant_8/commits/f24da54fee7e3cb0ba28fbb69d56055d310afb53"},{"sha":"341a8b3a15959e123e920b0b549faa3786903107","author":{"email":"5c2dd944dde9e08881bef0894fe7b22a5c9c4b06@w1.fi","name":"Jouni Malinen"},"message":"EAP-pwd server: Fix Total-Length parsing for fragment reassembly\n\nThe remaining number of bytes in the message could be smaller than the\nTotal-Length field size, so the length needs to be explicitly checked\nprior to reading the field and decrementing the len variable. This could\nhave resulted in the remaining length becoming negative and interpreted\nas a huge positive integer.\n\nIn addition, check that there is no already started fragment in progress\nbefore allocating a new buffer for reassembling fragments. This avoid a\npotential memory leak when processing invalid message.\n\nChange-Id: I1501af3aefa3a9784704cbd8ec625f66b4bb5df5\nSigned-off-by: Jouni Malinen <j@w1.fi>","distinct":true,"url":"https://api.github.com/repos/temasek/android_external_wpa_supplicant_8/commits/341a8b3a15959e123e920b0b549faa3786903107"},{"sha":"4d4d614ba37df22fdd0cfdebf1761fc6ba34327d","author":{"email":"5c2dd944dde9e08881bef0894fe7b22a5c9c4b06@w1.fi","name":"Jouni Malinen"},"message":"EAP-pwd peer: Fix asymmetric fragmentation behavior\n\nThe L (Length) and M (More) flags needs to be cleared before deciding\nwhether the locally generated response requires fragmentation. This\nfixes an issue where these flags from the server could have been invalid\nfor the following message. In some cases, this could have resulted in\ntriggering the wpabuf security check that would terminate the process\ndue to invalid buffer allocation.\n\nChange-Id: Id3bb2a36b7b0a040e81ec1f1064934047606259a\nSigned-off-by: Jouni Malinen <j@w1.fi>","distinct":true,"url":"https://api.github.com/repos/temasek/android_external_wpa_supplicant_8/commits/4d4d614ba37df22fdd0cfdebf1761fc6ba34327d"},{"sha":"bc7e82d9c6f46b7cd37aa134240004e525302c5b","author":{"email":"5c2dd944dde9e08881bef0894fe7b22a5c9c4b06@w1.fi","name":"Jouni Malinen"},"message":"AP WMM: Fix integer underflow in WMM Action frame parser\n\nThe length of the WMM Action frame was not properly validated and the\nlength of the information elements (int left) could end up being\nnegative. This would result in reading significantly past the stack\nbuffer while parsing the IEs in ieee802_11_parse_elems() and while doing\nso, resulting in segmentation fault.\n\nThis can result in an invalid frame being used for a denial of service\nattack (hostapd process killed) against an AP with a driver that uses\nhostapd for management frame processing (e.g., all mac80211-based\ndrivers).\n\nThanks to Kostya Kortchinsky of Google security team for discovering and\nreporting this issue.\n\nChange-Id: I8f1f9734f74124df51eba4f075f7b9bc14af1332\nSigned-off-by: Jouni Malinen <j@w1.fi>","distinct":true,"url":"https://api.github.com/repos/temasek/android_external_wpa_supplicant_8/commits/bc7e82d9c6f46b7cd37aa134240004e525302c5b"},{"sha":"688bbc219117f63dbfd00323735654c39bfa87cf","author":{"email":"5c2dd944dde9e08881bef0894fe7b22a5c9c4b06@w1.fi","name":"Jouni Malinen"},"message":"WPS: Fix HTTP chunked transfer encoding parser\n\nstrtoul() return value may end up overflowing the int h->chunk_size and\nresulting in a negative value to be stored as the chunk_size. This could\nresult in the following memcpy operation using a very large length\nargument which would result in a buffer overflow and segmentation fault.\n\nThis could have been used to cause a denial service by any device that\nhas been authorized for network access (either wireless or wired). This\nwould affect both the WPS UPnP functionality in a WPS AP (hostapd with\nupnp_iface parameter set in the configuration) and WPS ER\n(wpa_supplicant with WPS_ER_START control interface command used).\n\nValidate the parsed chunk length value to avoid this. In addition to\nrejecting negative values, we can also reject chunk size that would be\nlarger than the maximum configured body length.\n\nThanks to Kostya Kortchinsky of Google security team for discovering and\nreporting this issue.\n\nChange-Id: Ie9a6d41f2f7dea0010a24147257547fc6479b499\nSigned-off-by: Jouni Malinen <j@w1.fi>","distinct":true,"url":"https://api.github.com/repos/temasek/android_external_wpa_supplicant_8/commits/688bbc219117f63dbfd00323735654c39bfa87cf"},{"sha":"b252e871c176d499b19015f4028b685f2943fa13","author":{"email":"6b4d6306c7e411325752438d4db039d325f08f9d@gmail.com","name":"Janson Kang"},"message":"Merge branch 'cm-12.1' of github.com:CyanogenMod/android_external_wpa_supplicant_8 into cm-12.1","distinct":true,"url":"https://api.github.com/repos/temasek/android_external_wpa_supplicant_8/commits/b252e871c176d499b19015f4028b685f2943fa13"}]}