From a6e5bd56548edffffcf696a7f680827db16e7fcf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Thu, 23 Jul 2015 12:14:13 +0200 Subject: [PATCH] Fix bug with extension-less ServerHello https://tls.mbed.org/discussions/bug-report-issues/server-hello-parsing-bug in_hslen include the length of the handshake header. (We might want to change that in the future, as it is a bit annoying.) --- ChangeLog | 2 ++ library/ssl_cli.c | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 77a5b9da7..184d31d07 100644 --- a/ChangeLog +++ b/ChangeLog @@ -6,6 +6,8 @@ Bugfix * Fix segfault in the benchmark program when benchmarking DHM. * Fix build error with CMake and pre-4.5 versions of GCC (found by Hugo Leisink). + * Fix bug when parsing a ServerHello without extensions (found by David + Sears). = mbed TLS 2.0.0 released 2015-07-13 diff --git a/library/ssl_cli.c b/library/ssl_cli.c index 1d683d307..b09a7ab62 100644 --- a/library/ssl_cli.c +++ b/library/ssl_cli.c @@ -1269,7 +1269,7 @@ static int ssl_parse_server_hello( mbedtls_ssl_context *ssl ) return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); } - if( ssl->in_hslen > 39 + n ) + if( ssl->in_hslen > mbedtls_ssl_hs_hdr_len( ssl ) + 39 + n ) { ext_len = ( ( buf[38 + n] << 8 ) | ( buf[39 + n] ) ); @@ -1281,7 +1281,7 @@ static int ssl_parse_server_hello( mbedtls_ssl_context *ssl ) return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); } } - else if( ssl->in_hslen == 38 + n ) + else if( ssl->in_hslen == mbedtls_ssl_hs_hdr_len( ssl ) + 38 + n ) { ext_len = 0; }