From d15f2d98ef8e9d04143f68aa8697194cc6b24246 Mon Sep 17 00:00:00 2001 From: Miod Vallat Date: Wed, 4 Jun 2014 03:59:58 -0400 Subject: Fix off-by-one errors in ssl_cipher_get_evp() In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays. Bug discovered and fixed by Miod Vallat from the OpenBSD team. PR#3375 --- ssl/ssl_ciph.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'ssl/ssl_ciph.c') diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c index 13127d725e..05b1e5e0db 100644 --- a/ssl/ssl_ciph.c +++ b/ssl/ssl_ciph.c @@ -563,7 +563,7 @@ int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc, break; } - if ((i < 0) || (i > SSL_ENC_NUM_IDX)) + if ((i < 0) || (i >= SSL_ENC_NUM_IDX)) *enc=NULL; else { @@ -597,7 +597,7 @@ int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc, i= -1; break; } - if ((i < 0) || (i > SSL_MD_NUM_IDX)) + if ((i < 0) || (i >= SSL_MD_NUM_IDX)) { *md=NULL; if (mac_pkey_type!=NULL) *mac_pkey_type = NID_undef; -- cgit v1.2.3