From 1c2684577720c0bfb1bbecc432d4ae39028a00bd Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Wed, 10 Jul 2019 11:37:19 +0100 Subject: [PATCH] Remove redundant length check during record header parsing The check is in terms of the internal input buffer length and is hence likely to be originally intended to protect against overflow of the input buffer when fetching data from the underlying transport in mbedtls_ssl_fetch_input(). For locality of reasoning, it's better to perform such a check close to where it's needed, and in fact, mbedtls_ssl_fetch_input() _does_ contain an equivalent bounds check, too, rendering the bounds check in question redundant. --- library/ssl_tls.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index d04602027..a0e992d32 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -4776,13 +4776,6 @@ static int ssl_parse_record_header( mbedtls_ssl_context *ssl ) * the presence of a CID. */ ssl->in_msglen = ( ssl->in_len[0] << 8 ) | ssl->in_len[1]; - if( ssl->in_msglen > MBEDTLS_SSL_IN_BUFFER_LEN - - (size_t)( ssl->in_msg - ssl->in_buf ) ) - { - MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) ); - return( MBEDTLS_ERR_SSL_INVALID_RECORD ); - } - MBEDTLS_SSL_DEBUG_MSG( 3, ( "input record: msgtype = %d, " "version = [%d:%d], msglen = %d", ssl->in_msgtype,