diff options
| author | Matt Caswell <matt@openssl.org> | 2017-05-11 11:31:57 +0100 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2017-05-11 13:13:04 +0100 |
| commit | 26b9172a50f1ad22ed94f9d11834ca75d380fe73 (patch) | |
| tree | 79b5bf52c4d3d1332c4e20d5462f54f068b56832 /ssl/statem/statem_clnt.c | |
| parent | b6fdc12d94d7527c3018492ab838cbcda81ba346 (diff) | |
Add some checks for trailing data after extension blocks
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3436)
Diffstat (limited to 'ssl/statem/statem_clnt.c')
| -rw-r--r-- | ssl/statem/statem_clnt.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c index 73dcff606e..b9b8da1679 100644 --- a/ssl/statem/statem_clnt.c +++ b/ssl/statem/statem_clnt.c @@ -1365,7 +1365,8 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) /* TLS extensions */ if (PACKET_remaining(pkt) == 0) { PACKET_null_init(&extpkt); - } else if (!PACKET_as_length_prefixed_2(pkt, &extpkt)) { + } else if (!PACKET_as_length_prefixed_2(pkt, &extpkt) + || PACKET_remaining(pkt) != 0) { al = SSL_AD_DECODE_ERROR; SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_BAD_LENGTH); goto f_err; @@ -2517,6 +2518,7 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt) PACKET extpkt; if (!PACKET_as_length_prefixed_2(pkt, &extpkt) + || PACKET_remaining(pkt) != 0 || !tls_collect_extensions(s, &extpkt, SSL_EXT_TLS1_3_NEW_SESSION_TICKET, &exts, &al, NULL, 1) @@ -3474,7 +3476,8 @@ static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL *s, PACKET *pkt) PACKET extensions; RAW_EXTENSION *rawexts = NULL; - if (!PACKET_as_length_prefixed_2(pkt, &extensions)) { + if (!PACKET_as_length_prefixed_2(pkt, &extensions) + || PACKET_remaining(pkt) != 0) { al = SSL_AD_DECODE_ERROR; SSLerr(SSL_F_TLS_PROCESS_ENCRYPTED_EXTENSIONS, SSL_R_LENGTH_MISMATCH); goto err; |