diff options
Diffstat (limited to 'src/eap_peer/eap_tnc.c')
| -rw-r--r-- | src/eap_peer/eap_tnc.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/eap_peer/eap_tnc.c b/src/eap_peer/eap_tnc.c index bc136470b334..25b9f124801a 100644 --- a/src/eap_peer/eap_tnc.c +++ b/src/eap_peer/eap_tnc.c @@ -243,7 +243,8 @@ static struct wpabuf * eap_tnc_process(struct eap_sm *sm, void *priv, message_length = WPA_GET_BE32(pos); pos += 4; - if (message_length < (u32) (end - pos)) { + if (message_length < (u32) (end - pos) || + message_length > 75000) { wpa_printf(MSG_DEBUG, "EAP-TNC: Invalid Message " "Length (%d; %ld remaining in this msg)", message_length, (long) (end - pos)); |