yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-26 06:45:44 +01:00
Code Issues Packages Projects Releases Wiki Activity

ssl_tls: Fix invalid buffer sizes during compression / decompression

Browse Source 
Adjust information passed to zlib to include already written data.
This commit is contained in:
Andrzej Kurek 2018-04-23 08:29:36 -04:00
parent 6f861a3be9
commit bb6661479f
2 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ChangeLog
View File

@ -26,6 +26,8 @@ Bugfix
the mbedtls_cipher_update() documentation. Contributed by Andy Leiserson. the mbedtls_cipher_update() documentation. Contributed by Andy Leiserson.
* Fix overriding and ignoring return values when parsing and writing to * Fix overriding and ignoring return values when parsing and writing to
a file in pk_sign program. Found by kevlut in #1142. a file in pk_sign program. Found by kevlut in #1142.
* Fix invalid buffer sizes passed to zlib during record compression and
decompression.
Changes Changes
* Improve testing in configurations that omit certain hashes or * Improve testing in configurations that omit certain hashes or

13
library/ssl_tls.c
View File

@ -2087,6 +2087,7 @@ static int ssl_compress_buf( mbedtls_ssl_context *ssl )
{ {
int ret; int ret;
unsigned char *msg_post = ssl->out_msg; unsigned char *msg_post = ssl->out_msg;
ptrdiff_t bytes_written = ssl->out_msg - ssl->out_buf;
size_t len_pre = ssl->out_msglen; size_t len_pre = ssl->out_msglen;
unsigned char *msg_pre = ssl->compress_buf; unsigned char *msg_pre = ssl->compress_buf;
@ -2106,7 +2107,7 @@ static int ssl_compress_buf( mbedtls_ssl_context *ssl )
ssl->transform_out->ctx_deflate.next_in = msg_pre; ssl->transform_out->ctx_deflate.next_in = msg_pre;
ssl->transform_out->ctx_deflate.avail_in = len_pre; ssl->transform_out->ctx_deflate.avail_in = len_pre;
ssl->transform_out->ctx_deflate.next_out = msg_post; ssl->transform_out->ctx_deflate.next_out = msg_post;
ssl->transform_out->ctx_deflate.avail_out = MBEDTLS_SSL_BUFFER_LEN; ssl->transform_out->ctx_deflate.avail_out = MBEDTLS_SSL_BUFFER_LEN - bytes_written;
ret = deflate( &ssl->transform_out->ctx_deflate, Z_SYNC_FLUSH ); ret = deflate( &ssl->transform_out->ctx_deflate, Z_SYNC_FLUSH );
if( ret != Z_OK ) if( ret != Z_OK )
@ -2116,7 +2117,7 @@ static int ssl_compress_buf( mbedtls_ssl_context *ssl )
} }
ssl->out_msglen = MBEDTLS_SSL_BUFFER_LEN - ssl->out_msglen = MBEDTLS_SSL_BUFFER_LEN -
ssl->transform_out->ctx_deflate.avail_out; ssl->transform_out->ctx_deflate.avail_out - bytes_written;
MBEDTLS_SSL_DEBUG_MSG( 3, ( "after compression: msglen = %d, ", MBEDTLS_SSL_DEBUG_MSG( 3, ( "after compression: msglen = %d, ",
ssl->out_msglen ) ); ssl->out_msglen ) );
@ -2133,6 +2134,7 @@ static int ssl_decompress_buf( mbedtls_ssl_context *ssl )
{ {
int ret; int ret;
unsigned char *msg_post = ssl->in_msg; unsigned char *msg_post = ssl->in_msg;
ptrdiff_t bytes_written = ssl->in_msg - ssl->in_buf;
size_t len_pre = ssl->in_msglen; size_t len_pre = ssl->in_msglen;
unsigned char *msg_pre = ssl->compress_buf; unsigned char *msg_pre = ssl->compress_buf;
@ -2152,7 +2154,8 @@ static int ssl_decompress_buf( mbedtls_ssl_context *ssl )
ssl->transform_in->ctx_inflate.next_in = msg_pre; ssl->transform_in->ctx_inflate.next_in = msg_pre;
ssl->transform_in->ctx_inflate.avail_in = len_pre; ssl->transform_in->ctx_inflate.avail_in = len_pre;
ssl->transform_in->ctx_inflate.next_out = msg_post; ssl->transform_in->ctx_inflate.next_out = msg_post;
ssl->transform_in->ctx_inflate.avail_out = MBEDTLS_SSL_MAX_CONTENT_LEN; ssl->transform_in->ctx_inflate.avail_out = MBEDTLS_SSL_BUFFER_LEN -
bytes_written;
ret = inflate( &ssl->transform_in->ctx_inflate, Z_SYNC_FLUSH ); ret = inflate( &ssl->transform_in->ctx_inflate, Z_SYNC_FLUSH );
if( ret != Z_OK ) if( ret != Z_OK )
@ -2161,8 +2164,8 @@ static int ssl_decompress_buf( mbedtls_ssl_context *ssl )
return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED ); return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
} }
ssl->in_msglen = MBEDTLS_SSL_MAX_CONTENT_LEN - ssl->in_msglen = MBEDTLS_SSL_BUFFER_LEN -
ssl->transform_in->ctx_inflate.avail_out; ssl->transform_in->ctx_inflate.avail_out - bytes_written;
MBEDTLS_SSL_DEBUG_MSG( 3, ( "after decompression: msglen = %d, ", MBEDTLS_SSL_DEBUG_MSG( 3, ( "after decompression: msglen = %d, ",
ssl->in_msglen ) ); ssl->in_msglen ) );