From ad17fe9c377def269b4d96537f21427e4fddcdd2 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Thu, 16 Aug 2018 15:51:34 +0100 Subject: [PATCH 1/2] Fix overly strict bounds check in ssl_parse_certificate_request() --- library/ssl_cli.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/ssl_cli.c b/library/ssl_cli.c index 321d6367a..466608375 100644 --- a/library/ssl_cli.c +++ b/library/ssl_cli.c @@ -2721,7 +2721,7 @@ static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl ) * therefore the buffer length at this point must be greater than that * regardless of the actual code path. */ - if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n ) + if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n ) { MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) ); mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, From ad0fe92fb6e63673ad90c8618f096ccf5ba7b6db Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Thu, 16 Aug 2018 15:52:22 +0100 Subject: [PATCH 2/2] Adapt ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index abd5e61bb..f505b3886 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,6 +10,9 @@ Bugfix * Add ecc extensions only if an ecc based ciphersuite is used. This improves compliance to RFC 4492, and as a result, solves interoperability issues with BouncyCastle. Raised by milenamil in #1157. + * Fix overly strict bounds check in ssl_parse_certificate_request() + which could lead to valid CertificateRequest messages being rejected. + Fixes #1954. Changes * Copy headers preserving timestamps when doing a "make install".