yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-22 12:15:38 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix potential bad read of length

Browse Source
This commit is contained in:
Manuel Pégourié-Gonnard 2014-10-17 17:02:10 +02:00
parent ef9a6aec51
commit f7cdbc0e87
2 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ChangeLog
View File

@ -29,6 +29,8 @@ Bugfix
* Fix compiler warnings on iOS (found by Sander Niemeijer). * Fix compiler warnings on iOS (found by Sander Niemeijer).
* x509_crt_parse() did not increase total_failed on PEM error * x509_crt_parse() did not increase total_failed on PEM error
* Fix compile error with armcc in mpi_is_prime() * Fix compile error with armcc in mpi_is_prime()
* Fix potential bad read in parsing ServerHello (found by Adrien
Vialletelle).
Changes Changes
* Ciphersuites using SHA-256 or SHA-384 now require TLS 1.x (there is no * Ciphersuites using SHA-256 or SHA-384 now require TLS 1.x (there is no

13
library/ssl_cli.c
View File

@ -875,7 +875,7 @@ static int ssl_parse_server_hello( ssl_context *ssl )
{ {
int ret, i, comp; int ret, i, comp;
size_t n; size_t n;
size_t ext_len = 0; size_t ext_len;
unsigned char *buf, *ext; unsigned char *buf, *ext;
int renegotiation_info_seen = 0; int renegotiation_info_seen = 0;
int handshake_failure = 0; int handshake_failure = 0;
@ -981,7 +981,7 @@ static int ssl_parse_server_hello( ssl_context *ssl )
* 42+n . 43+n extensions length * 42+n . 43+n extensions length
* 44+n . 44+n+m extensions * 44+n . 44+n+m extensions
*/ */
if( ssl->in_hslen > 42 + n ) if( ssl->in_hslen > 43 + n )
{ {
ext_len = ( ( buf[42 + n] << 8 ) ext_len = ( ( buf[42 + n] << 8 )
| ( buf[43 + n] ) ); | ( buf[43 + n] ) );
@ -993,6 +993,15 @@ static int ssl_parse_server_hello( ssl_context *ssl )
return( POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO ); return( POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO );
} }
} }
else if( ssl->in_hslen == 42 + n )
{
ext_len = 0;
}
else
{
SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
return( POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO );
}
i = ( buf[39 + n] << 8 ) | buf[40 + n]; i = ( buf[39 + n] << 8 ) | buf[40 + n];
comp = buf[41 + n]; comp = buf[41 + n];