QuasarApp/openssl
4
0
Fork 0
mirror of https://github.com/QuasarApp/openssl.git synced 2025-05-09 16:09:47 +00:00
Code Issues Projects Releases Wiki Activity

Fix length check writing status request extension

Browse Source 
The status request extension did not correctly check its length, meaning
that writing the extension could go 2 bytes beyond the buffer size. In
practice this makes little difference because, due to logic in buffer.c the
buffer is actually over allocated by approximately 5k!

Issue reported by Guido Vranken.

Reviewed-by: Rich Salz <rsalz@openssl.org>
This commit is contained in:
Matt Caswell 2016-10-14 11:49:06 +01:00
parent 3bceb47a27
commit 8c9365a690
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ssl/t1_lib.c
View File

@ -1261,7 +1261,14 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf,
} else
extlen = 0;
if ((long)(limit - ret - 7 - extlen - idlen) < 0)
/*
* 2 bytes for status request type
* 2 bytes for status request len
* 1 byte for OCSP request type
* 2 bytes for length of ids
* 2 bytes for length of extensions
*/
if ((long)(limit - ret - 9 - extlen - idlen) < 0)
return NULL;
s2n(TLSEXT_TYPE_status_request, ret);
if (extlen + idlen > 0xFFF0)