yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-02-01 13:51:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'restricted/pr/522' into mbedtls-2.1-restricted-proposed

Browse source
This commit is contained in:
Simon Butcher 2018-11-07 00:07:31 +00:00
parent 6f682ee463 e6a5ee7b72
commit 3bc2b8be36
2 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ChangeLog
View file

@ -10,6 +10,11 @@ Security
one using PrintableString and the other UTF8String) or one using PrintableString and the other UTF8String) or
in the choice of upper and lower case. Reported by in the choice of upper and lower case. Reported by
HenrikRosenquistAndersson in #1784. HenrikRosenquistAndersson in #1784.
* Fix a flawed bounds check in server PSK hint parsing. In case the
incoming message buffer was placed within the first 64KB of address
space and a PSK-(EC)DHE ciphersuite was used, this allowed an attacker
to trigger a memory access up to 64KB beyond the incoming message buffer,
potentially leading to application crash or information disclosure.
Bugfix Bugfix
* Fix failure in hmac_drbg in the benchmark sample application, when * Fix failure in hmac_drbg in the benchmark sample application, when

4
library/ssl_cli.c
View file

@ -1884,7 +1884,7 @@ static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl,
* *
* opaque psk_identity_hint<0..2^16-1>; * opaque psk_identity_hint<0..2^16-1>;
*/ */
if( (*p) > end - 2 ) if( end - (*p) < 2 )
{ {
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message " MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message "
"(psk_identity_hint length)" ) ); "(psk_identity_hint length)" ) );
@ -1893,7 +1893,7 @@ static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl,
len = (*p)[0] << 8 | (*p)[1]; len = (*p)[0] << 8 | (*p)[1];
*p += 2; *p += 2;
if( (*p) > end -len ) if( end - (*p) < (int) len )
{ {
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message " MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message "
"(psk_identity_hint length)" ) ); "(psk_identity_hint length)" ) );