yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-01-09 23:25:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'upstream-restricted/pr/443' into mbedtls-1.3-restricted

Browse source
This commit is contained in:
Jaeden Amero 2018-01-29 13:23:49 +00:00
parent 6564d7a904 f472a829c6
commit 8ae366f356
2 changed files with 20 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
ChangeLog
View file

@ -33,6 +33,9 @@ Security
* Change default choice of DHE parameters from untrustworthy RFC 5114 * Change default choice of DHE parameters from untrustworthy RFC 5114
to RFC 3526 containing parameters generated in a nothing-up-my-sleeve to RFC 3526 containing parameters generated in a nothing-up-my-sleeve
manner. manner.
* Fix a potential heap buffer overread in ALPN extension parsing
(server-side). Could result in application crash, but only if an ALPN
name larger than 16 bytes had been configured on the server.
Features Features
* Allow comments in test data files. * Allow comments in test data files.

26
library/ssl_srv.c
View file

@ -791,25 +791,33 @@ static int ssl_parse_alpn_ext( ssl_context *ssl,
return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO ); return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
/* /*
* Use our order of preference * Validate peer's list (lengths)
*/ */
start = buf + 2; start = buf + 2;
end = buf + len; end = buf + len;
for( theirs = start; theirs != end; theirs += cur_len )
{
cur_len = *theirs++;
/* Current identifier must fit in list */
if( cur_len > (size_t)( end - theirs ) )
return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
/* Empty strings MUST NOT be included */
if( cur_len == 0 )
return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
}
/*
* Use our order of preference
*/
for( ours = ssl->alpn_list; *ours != NULL; ours++ ) for( ours = ssl->alpn_list; *ours != NULL; ours++ )
{ {
ours_len = strlen( *ours ); ours_len = strlen( *ours );
for( theirs = start; theirs != end; theirs += cur_len ) for( theirs = start; theirs != end; theirs += cur_len )
{ {
/* If the list is well formed, we should get equality first */
if( theirs > end )
return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
cur_len = *theirs++; cur_len = *theirs++;
/* Empty strings MUST NOT be included */
if( cur_len == 0 )
return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
if( cur_len == ours_len && if( cur_len == ours_len &&
memcmp( theirs, *ours, cur_len ) == 0 ) memcmp( theirs, *ours, cur_len ) == 0 )
{ {