generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Validate ClientHello session_id field length and send alert on failure

Browse Source 
RT#4080

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
This commit is contained in:
Alessandro Ghedini 2015-10-08 19:56:03 +02:00 committed by Matt Caswell
parent aa291c62a7
commit 293b5ca477
2 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ssl/ssl_sess.c
View File

@ -529,12 +529,8 @@ int ssl_get_prev_session(SSL *s, const PACKET *ext, const PACKET *session_id)
int fatal = 0; int fatal = 0;
int try_session_cache = 1; int try_session_cache = 1;
int r; int r;
size_t len = PACKET_remaining(session_id);
if (len > SSL_MAX_SSL_SESSION_ID_LENGTH) if (PACKET_remaining(session_id) == 0)
goto err;
if (len == 0)
try_session_cache = 0; try_session_cache = 0;
/* sets s->tlsext_ticket_expected and extended master secret flag */ /* sets s->tlsext_ticket_expected and extended master secret flag */

12
ssl/statem/statem_srvr.c
View File

@ -1082,6 +1082,12 @@ MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)
goto f_err; goto f_err;
} }
if (session_id_len > SSL_MAX_SSL_SESSION_ID_LENGTH) {
al = SSL_AD_DECODE_ERROR;
SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
goto f_err;
}
if (!PACKET_get_sub_packet(pkt, &cipher_suites, cipher_len) if (!PACKET_get_sub_packet(pkt, &cipher_suites, cipher_len)
|| !PACKET_get_sub_packet(pkt, &session_id, session_id_len) || !PACKET_get_sub_packet(pkt, &session_id, session_id_len)
|| !PACKET_get_sub_packet(pkt, &challenge, challenge_len) || !PACKET_get_sub_packet(pkt, &challenge, challenge_len)
@ -1116,6 +1122,12 @@ MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)
goto f_err; goto f_err;
} }
if (PACKET_remaining(&session_id) > SSL_MAX_SSL_SESSION_ID_LENGTH) {
al = SSL_AD_DECODE_ERROR;
SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
goto f_err;
}
if (SSL_IS_DTLS(s)) { if (SSL_IS_DTLS(s)) {
if (!PACKET_get_length_prefixed_1(pkt, &cookie)) { if (!PACKET_get_length_prefixed_1(pkt, &cookie)) {
al = SSL_AD_DECODE_ERROR; al = SSL_AD_DECODE_ERROR;