diff options
| author | Emilia Kasper <emilia@openssl.org> | 2014-12-01 15:04:02 +0100 |
|---|---|---|
| committer | Emilia Kasper <emilia@openssl.org> | 2014-12-05 16:44:20 +0100 |
| commit | 321ba85899ce7246db3791457c711ad586b6d3f8 (patch) | |
| tree | 2ab255f046bf4e5e02bf4adefb675b1984b0e6a1 | |
| parent | fcabfc66aeade294c06259c885d4df1eab06b86c (diff) | |
Reject elliptic curve lists of odd lengths.
The Supported Elliptic Curves extension contains a vector of NamedCurves
of 2 bytes each, so the total length must be even. Accepting odd-length
lists was observed to lead to a non-exploitable one-byte out-of-bounds
read in the latest development branches (1.0.2 and master). Released
versions of OpenSSL are not affected.
Thanks to Felix Groebert of the Google Security Team for reporting this issue.
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 33d5ba862939ff8db70a9e36fc9a326fab3e8d98)
| -rw-r--r-- | ssl/t1_lib.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index c91489da6f..1a5f4c1c23 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -1199,7 +1199,9 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in ellipticcurvelist_length += (*(sdata++)); if (ellipticcurvelist_length != size - 2 || - ellipticcurvelist_length < 1) + ellipticcurvelist_length < 1 || + /* Each NamedCurve is 2 bytes. */ + ellipticcurvelist_length & 1) { *al = TLS1_AD_DECODE_ERROR; return 0; |