EAP-pwd server: Fix last fragment length validation
All but the last fragment had their length checked against the remaining
room in the reassembly buffer. This allowed a suitably constructed last
fragment frame to try to add extra data that would go beyond the buffer.
The length validation code in wpabuf_put_data() prevents an actual
buffer write overflow from occurring, but this results in process
termination. (CVE-2015-5314)
Signed-off-by: Jouni Malinen <j@w1.fi>
Git-commit: bef802ece03f9ae9d52a21f0cf4f1bc2c5a1f8aa
Git-repo: git://w1.fi/srv/git/hostap.git
Change-Id: Ia283ce184fc880e2fcf7e60e40952cbfc2961709
CRs-Fixed: 937515