From 6992eb762cd7364208acb68abfe5391aa2d0322d Mon Sep 17 00:00:00 2001
From: Paul Bakker <p.j.bakker@polarssl.org>
Date: Tue, 31 Dec 2013 11:35:16 +0100
Subject: [PATCH] Fixed potential overflow in certificate size in
 ssl_write_certificate()

---
 ChangeLog         | 2 ++
 library/ssl_tls.c | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 36179157a..506d96a8a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -32,6 +32,8 @@ Bugfix
    * Fixed x509_crt_parse_path() bug on Windows platforms
    * Added missing MPI_CHK() around some statements in mpi_div_mpi() (found by
      TrustInSoft)
+   * Fixed potential overflow in certificate size verification in
+     ssl_write_certificate() (found by TrustInSoft)
 
 Security
    * Possible remotely-triggered out-of-bounds memory access fixed (found by
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 6ea282180..e73802880 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -2453,7 +2453,7 @@ int ssl_write_certificate( ssl_context *ssl )
     while( crt != NULL )
     {
         n = crt->raw.len;
-        if( i + 3 + n > SSL_MAX_CONTENT_LEN )
+        if( n > SSL_MAX_CONTENT_LEN - 3 - i )
         {
             SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d",
                            i + 3 + n, SSL_MAX_CONTENT_LEN ) );