diff options
author | Tim Hudson <tjh@cryptsoft.com> | 2014-04-27 01:55:47 +1000 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2014-05-11 11:32:17 +0100 |
commit | 011ee91105f00cb2465110ce6431b11b51556d08 (patch) | |
tree | 526960367596785b61377d6c13aef6aace88b078 /ssl | |
parent | 2c4144638ae7739871db0574265952dc350c5dfa (diff) |
safety check to ensure we dont send out beyond the users buffer
Diffstat (limited to 'ssl')
-rw-r--r-- | ssl/s3_pkt.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c index 8290f87290..0d3f47780a 100644 --- a/ssl/s3_pkt.c +++ b/ssl/s3_pkt.c @@ -777,6 +777,21 @@ int ssl3_write_bytes(SSL *s, int type, const void *buf_, int len) return tot; } + /* ensure that if we end up with a smaller value of data to write + * out than the the original len from a write which didn't complete + * for non-blocking I/O and also somehow ended up avoiding + * the check for this in ssl3_write_pending/SSL_R_BAD_WRITE_RETRY as + * it must never be possible to end up with (len-tot) as a large + * number that will then promptly send beyond the end of the users + * buffer ... so we trap and report the error in a way the user + * will notice + */ + if ( len < tot) + { + SSLerr(SSL_F_SSL3_WRITE_BYTES,SSL_R_BAD_LENGTH); + return(-1); + } + n=(len-tot); for (;;) { |