yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-01-23 23:01:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix potential bad read in parsing ServerHello

Browse source
This commit is contained in:
Manuel Pégourié-Gonnard 2014-10-23 14:58:09 +02:00
parent 6b44038913
commit 066c1f60bb
2 changed files with 15 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
ChangeLog
View file

@ -7,6 +7,10 @@ Security
(server is not affected if it doesn't ask for a client certificate). (server is not affected if it doesn't ask for a client certificate).
(Found using Codenomicon Defensics.) (Found using Codenomicon Defensics.)
Bugfix
* Fix potential bad read in parsing ServerHello (found by Adrien
Vialletelle).
Changes Changes
* X.509 certificates with more than one AttributeTypeAndValue per * X.509 certificates with more than one AttributeTypeAndValue per
RelativeDistinguishedName are not accepted any more. RelativeDistinguishedName are not accepted any more.

13
library/ssl_cli.c
View file

@ -377,7 +377,7 @@ static int ssl_parse_server_hello( ssl_context *ssl )
#endif #endif
int ret, i, comp; int ret, i, comp;
size_t n; size_t n;
size_t ext_len = 0; size_t ext_len;
unsigned char *buf, *ext; unsigned char *buf, *ext;
int renegotiation_info_seen = 0; int renegotiation_info_seen = 0;
int handshake_failure = 0; int handshake_failure = 0;
@ -464,7 +464,7 @@ static int ssl_parse_server_hello( ssl_context *ssl )
* 42+n . 43+n extensions length * 42+n . 43+n extensions length
* 44+n . 44+n+m extensions * 44+n . 44+n+m extensions
*/ */
if( ssl->in_hslen > 42 + n ) if( ssl->in_hslen > 43 + n )
{ {
ext_len = ( ( buf[42 + n] << 8 ) ext_len = ( ( buf[42 + n] << 8 )
| ( buf[43 + n] ) ); | ( buf[43 + n] ) );
@ -476,6 +476,15 @@ static int ssl_parse_server_hello( ssl_context *ssl )
return( POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO ); return( POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO );
} }
} }
else if( ssl->in_hslen == 42 + n )
{
ext_len = 0;
}
else
{
SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
return( POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO );
}
i = ( buf[39 + n] << 8 ) | buf[40 + n]; i = ( buf[39 + n] << 8 ) | buf[40 + n];
comp = buf[41 + n]; comp = buf[41 + n];