[SECURITY] Prevent rhostname array overflow

[ghsecuritylab]

This is an automatically generated security fix for a vulnerability detected in your code which is a variant of CVE-2020-8597.

You can read in more detail about this vulnerability in CERT Advisory VU#782301.

The vulnerability occurs because, given that vallen was checked to be less than len, it can never be the case that vallen >= len + sizeof(rhostname). Therefore, rhostname never gets trimmed and the rhostname array may overflow.

While this PR was generated for your project automatically, the supporting analysis was performed and verified by the GitHub Security Lab.

The original finding was reported by Ilja Van Sprundel from IOActive.

The proposed patch was developed by Paul Mackerras (paulusmack) from the Samba project in
paulusmack/ppp@8d7970b#diff-b7f5f2404cf3f5c09b1f8ad9364bb340.

The original vulnerability got assigned CVE-2020-8597 which has a CVSS v3.1 Base Score of 9.8/10.

Source

The source code that generated and submitted this PR is based on JLLeitschuh/bulk-security-pr-generator.

Opting-Out

This bot will respect the ROBOTS.txt format. If you'd like to opt-out of any future automated security vulnerability fixes like this, please consider adding a file called
.github/GH-ROBOTS.txt to your repository with the line:

'''
User-agent: GSL/bulk-security-pr-generator
Disallow: *
'''

Alternatively, if this project is no longer actively maintained, consider archiving the repository.

CLA Requirements

This section is only relevant if your project requires contributors to sign a Contributor License Agreement (CLA) for external contributions.

It is unlikely that we will be able to directly sign CLAs. However, all contributed commits are already automatically signed-off.

The meaning of a signoff depends on the project, but it typically certifies that committer has the rights to submit this work under the same license and agrees to a Developer Certificate of Origin
(see https://developercertificate.org/ for more information).

- Git Commit Signoff documentation

If signing your organization's CLA is a strict-requirement for merging this contribution, please feel free to close this PR.

[googlebot]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.

---

What to do if you already signed the CLA

Individual signers

• It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

• Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
• The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
• The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

[googlebot]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.

---

What to do if you already signed the CLA

Individual signers

• It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

• Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
• The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
• The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

[codecov-io]

Codecov Report

Merging #516 into master will decrease coverage by <.01%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master     #516      +/-   ##
==========================================
- Coverage   54.16%   54.16%   -0.01%     
==========================================
  Files         329      329              
  Lines       57161    57161              
==========================================
- Hits        30964    30962       -2     
- Misses      26197    26199       +2

Impacted Files	Coverage Δ
src/lib/profiles/security/WeaveCert.cpp	88.5% <0%> (-0.46%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 746977a...438bd81. Read the comment docs.

[gerickson]

This has already been fixed identically in lwip upstream (see http://git.savannah.nongnu.org/cgit/lwip.git/tree/src/netif/ppp/eap.c#n1426). However, OpenWeave doesn't use PPP or EAP in LwIP, so this is a no-op for OpenWeave one way or another.