From 5bd15cbfa09bc85b77c905ebff0bd5b57bab3888 Mon Sep 17 00:00:00 2001 From: mohammad1603 Date: Wed, 28 Feb 2018 04:30:59 -0800 Subject: [PATCH] Avoid wraparound for ssl->in_left Add check to avoid wraparound for ssl->in_left --- library/ssl_tls.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 1de5eaab6..0d0660e6f 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -2422,6 +2422,14 @@ int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want ) if( ret < 0 ) return( ret ); + // At this point ret value is positive, verify that adding ret + // value to ssl->in_left doesn't cause a wraparound + if (ssl->in_left + (size_t)ret < ssl->in_left) + { + MBEDTLS_SSL_DEBUG_MSG( 1, ( "wraparound happened over in_left value" ) ); + return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); + } + ssl->in_left += ret; } }