yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-05-11 21:32:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'upstream-restricted/pr/442' into mbedtls-2.1-restricted

Browse source
This commit is contained in:
Gilles Peskine 2018-01-23 00:47:43 +01:00
parent b9088ee537 022954f4bd
commit a2ef78d50c
2 changed files with 20 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
ChangeLog
View file

@ -38,6 +38,9 @@ Security
corrupt 6 bytes on the peer's heap, potentially leading to crash or
remote code execution. This can be triggered remotely from either
side in both TLS and DTLS.
* Fix a potential heap buffer overread in ALPN extension parsing
(server-side). Could result in application crash, but only if an ALPN
name larger than 16 bytes had been configured on the server.
Features
* Allow comments in test data files.

26
library/ssl_srv.c
View file

@ -539,25 +539,33 @@ static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
/*
* Use our order of preference
* Validate peer's list (lengths)
*/
start = buf + 2;
end = buf + len;
for( theirs = start; theirs != end; theirs += cur_len )
{
cur_len = *theirs++;
/* Current identifier must fit in list */
if( cur_len > (size_t)( end - theirs ) )
return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
/* Empty strings MUST NOT be included */
if( cur_len == 0 )
return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
}
/*
* Use our order of preference
*/
for( ours = ssl->conf->alpn_list; *ours != NULL; ours++ )
{
ours_len = strlen( *ours );
for( theirs = start; theirs != end; theirs += cur_len )
{
/* If the list is well formed, we should get equality first */
if( theirs > end )
return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
cur_len = *theirs++;
/* Empty strings MUST NOT be included */
if( cur_len == 0 )
return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
if( cur_len == ours_len &&
memcmp( theirs, *ours, cur_len ) == 0 )
{