[PATCH] wolfSSL: Reject ECDH peer keys with unexpected length

[Paul Adelsbach]

crypto_ecdh_set_peerkey() ignored any bytes past the expected key
length. Require an exact length match, as the OpenSSL implementation
does. This fixes the owe_invalid_assoc_resp test case where a 33-octet
key was accepted.

Signed-off-by: Paul Adelsbach <paul.adelsbach at wolfssl.com>
---
 src/crypto/crypto_wolfssl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/crypto/crypto_wolfssl.c b/src/crypto/crypto_wolfssl.c
index d2541fde5..0916aa4c9 100644
--- a/src/crypto/crypto_wolfssl.c
+++ b/src/crypto/crypto_wolfssl.c
@@ -2241,8 +2241,8 @@ struct wpabuf * crypto_ecdh_set_peerkey(struct crypto_ecdh *ecdh, int inc_y,
 	ecc_point *point = NULL;
 	size_t need_key_len = inc_y ? 2 * key_len : key_len;
 
-	if (len < need_key_len) {
-		LOG_WOLF_ERROR("key len too small");
+	if (len != need_key_len) {
+		LOG_WOLF_ERROR("invalid key len");
 		goto fail;
 	}
 	pubkey = wpabuf_alloc(1 + 2 * key_len);
-- 
2.51.0