diff options
author | Dr. Stephen Henson <steve@openssl.org> | 2010-11-16 14:26:18 +0000 |
---|---|---|
committer | Dr. Stephen Henson <steve@openssl.org> | 2010-11-16 14:26:18 +0000 |
commit | 2ae47ddbc27505652b855449b23d80614c864329 (patch) | |
tree | 3226d51656866b86d24cdfc24a28d673a5268cf1 /ssl | |
parent | 3e8b8b899053124697217173b039ff3e45578c58 (diff) |
fix CVE-2010-3864
Diffstat (limited to 'ssl')
-rw-r--r-- | ssl/t1_lib.c | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index d61c08c8ef..0cc8320e17 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -432,14 +432,23 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in switch (servname_type) { case TLSEXT_NAMETYPE_host_name: - if (s->session->tlsext_hostname == NULL) + if (!s->hit) { - if (len > TLSEXT_MAXLEN_host_name || - ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)) + if(s->session->tlsext_hostname) + { + *al = SSL_AD_DECODE_ERROR; + return 0; + } + if (len > TLSEXT_MAXLEN_host_name) { *al = TLS1_AD_UNRECOGNIZED_NAME; return 0; } + if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL) + { + *al = TLS1_AD_INTERNAL_ERROR; + return 0; + } memcpy(s->session->tlsext_hostname, sdata, len); s->session->tlsext_hostname[len]='\0'; if (strlen(s->session->tlsext_hostname) != len) { @@ -452,7 +461,8 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in } else - s->servername_done = strlen(s->session->tlsext_hostname) == len + s->servername_done = s->session->tlsext_hostname + && strlen(s->session->tlsext_hostname) == len && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0; break; |