Add checks to validate client_verify_data pointer and length before
processing in handle_session_command1. Prevents NULL pointer dereference
when client omits verifier data in Session_Command1, which could cause
device crash during provisioning (remote DoS attack).
We would like to thank Pavel Kohout from Aisle Research for reporting
this vulnerability along with a mitigation strategy.
Mahavir Jain
a5601fbf0d