The WPS UPnP function in hostapd when using WPS AP and wpa_supplicant when using WPS external registrar (ER) 0.7.0 through 2.4 allows remote attackers to cause a denial of service (crash) via a negative chunk length which triggers an out-of-bounds read or heap-based buffer overflow.