From 157cffebab106547939fb799bd5558d4747ec931 Mon Sep 17 00:00:00 2001 From: Ronald Cron Date: Thu, 23 Apr 2020 16:41:44 +0200 Subject: [PATCH] Use defines to check alpn ext list validity Signed-off-by: Ronald Cron --- include/mbedtls/ssl.h | 3 +++ library/ssl_tls.c | 4 +++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h index f5cd97714..7f742ad4c 100644 --- a/include/mbedtls/ssl.h +++ b/include/mbedtls/ssl.h @@ -138,6 +138,9 @@ #define MBEDTLS_SSL_TRANSPORT_DATAGRAM 1 /*!< DTLS */ #define MBEDTLS_SSL_MAX_HOST_NAME_LEN 255 /*!< Maximum host name defined in RFC 1035 */ +#define MBEDTLS_SSL_MAX_ALPN_NAME_LEN 255 /*!< Maximum size in bytes of a protocol name in alpn ext., RFC 7301 */ + +#define MBEDTLS_SSL_MAX_ALPN_LIST_LEN 65535 /*!< Maximum size in bytes of list in alpn ext., RFC 7301 */ /* RFC 6066 section 4, see also mfl_code_to_length in ssl_tls.c * NONE must be zero so that memset()ing structure to zero works */ diff --git a/library/ssl_tls.c b/library/ssl_tls.c index cbec74fe8..9bc4fa81b 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -7589,7 +7589,9 @@ int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **prot cur_len = strlen( *p ); tot_len += cur_len; - if( cur_len == 0 || cur_len > 255 || tot_len > 65535 ) + if( ( cur_len == 0 ) || + ( cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN ) || + ( tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN ) ) return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); }