yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-25 16:45:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

ssl_tls: Fix invalid buffer sizes during compression / decompression

Browse Source 
Adjust information passed to zlib to include already written data.
This commit is contained in:
Andrzej Kurek 2018-04-20 07:58:53 -04:00
parent 7aeb470f61
commit 5462e02874
2 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ChangeLog
View File

@ -55,6 +55,8 @@ Bugfix
in the internal buffers; these cases lead to deadlocks in case in the internal buffers; these cases lead to deadlocks in case
event-driven I/O was used. event-driven I/O was used.
Found and reported by Hubert Mis in #772. Found and reported by Hubert Mis in #772.
* Fix invalid buffer sizes passed to zlib during record compression and
decompression.
Changes Changes
* Remove some redundant code in bignum.c. Contributed by Alexey Skalozub. * Remove some redundant code in bignum.c. Contributed by Alexey Skalozub.

13
library/ssl_tls.c
View File

@ -2108,6 +2108,7 @@ static int ssl_compress_buf( mbedtls_ssl_context *ssl )
{ {
int ret; int ret;
unsigned char *msg_post = ssl->out_msg; unsigned char *msg_post = ssl->out_msg;
ptrdiff_t bytes_written = ssl->out_msg - ssl->out_buf;
size_t len_pre = ssl->out_msglen; size_t len_pre = ssl->out_msglen;
unsigned char *msg_pre = ssl->compress_buf; unsigned char *msg_pre = ssl->compress_buf;
@ -2127,7 +2128,7 @@ static int ssl_compress_buf( mbedtls_ssl_context *ssl )
ssl->transform_out->ctx_deflate.next_in = msg_pre; ssl->transform_out->ctx_deflate.next_in = msg_pre;
ssl->transform_out->ctx_deflate.avail_in = len_pre; ssl->transform_out->ctx_deflate.avail_in = len_pre;
ssl->transform_out->ctx_deflate.next_out = msg_post; ssl->transform_out->ctx_deflate.next_out = msg_post;
ssl->transform_out->ctx_deflate.avail_out = MBEDTLS_SSL_BUFFER_LEN; ssl->transform_out->ctx_deflate.avail_out = MBEDTLS_SSL_BUFFER_LEN - bytes_written;
ret = deflate( &ssl->transform_out->ctx_deflate, Z_SYNC_FLUSH ); ret = deflate( &ssl->transform_out->ctx_deflate, Z_SYNC_FLUSH );
if( ret != Z_OK ) if( ret != Z_OK )
@ -2137,7 +2138,7 @@ static int ssl_compress_buf( mbedtls_ssl_context *ssl )
} }
ssl->out_msglen = MBEDTLS_SSL_BUFFER_LEN - ssl->out_msglen = MBEDTLS_SSL_BUFFER_LEN -
ssl->transform_out->ctx_deflate.avail_out; ssl->transform_out->ctx_deflate.avail_out - bytes_written;
MBEDTLS_SSL_DEBUG_MSG( 3, ( "after compression: msglen = %d, ", MBEDTLS_SSL_DEBUG_MSG( 3, ( "after compression: msglen = %d, ",
ssl->out_msglen ) ); ssl->out_msglen ) );
@ -2154,6 +2155,7 @@ static int ssl_decompress_buf( mbedtls_ssl_context *ssl )
{ {
int ret; int ret;
unsigned char *msg_post = ssl->in_msg; unsigned char *msg_post = ssl->in_msg;
ptrdiff_t bytes_written = ssl->in_msg - ssl->in_buf;
size_t len_pre = ssl->in_msglen; size_t len_pre = ssl->in_msglen;
unsigned char *msg_pre = ssl->compress_buf; unsigned char *msg_pre = ssl->compress_buf;
@ -2173,7 +2175,8 @@ static int ssl_decompress_buf( mbedtls_ssl_context *ssl )
ssl->transform_in->ctx_inflate.next_in = msg_pre; ssl->transform_in->ctx_inflate.next_in = msg_pre;
ssl->transform_in->ctx_inflate.avail_in = len_pre; ssl->transform_in->ctx_inflate.avail_in = len_pre;
ssl->transform_in->ctx_inflate.next_out = msg_post; ssl->transform_in->ctx_inflate.next_out = msg_post;
ssl->transform_in->ctx_inflate.avail_out = MBEDTLS_SSL_MAX_CONTENT_LEN; ssl->transform_in->ctx_inflate.avail_out = MBEDTLS_SSL_BUFFER_LEN -
bytes_written;
ret = inflate( &ssl->transform_in->ctx_inflate, Z_SYNC_FLUSH ); ret = inflate( &ssl->transform_in->ctx_inflate, Z_SYNC_FLUSH );
if( ret != Z_OK ) if( ret != Z_OK )
@ -2182,8 +2185,8 @@ static int ssl_decompress_buf( mbedtls_ssl_context *ssl )
return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED ); return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
} }
ssl->in_msglen = MBEDTLS_SSL_MAX_CONTENT_LEN - ssl->in_msglen = MBEDTLS_SSL_BUFFER_LEN -
ssl->transform_in->ctx_inflate.avail_out; ssl->transform_in->ctx_inflate.avail_out - bytes_written;
MBEDTLS_SSL_DEBUG_MSG( 3, ( "after decompression: msglen = %d, ", MBEDTLS_SSL_DEBUG_MSG( 3, ( "after decompression: msglen = %d, ",
ssl->in_msglen ) ); ssl->in_msglen ) );