From 8124ebcd788fc7dc33e3f6eff58a87836d3aaeee Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Thu, 22 Nov 2012 14:15:00 +0000 Subject: [PATCH] reject zero length point format list or supported curves extensions --- ssl/t1_lib.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index eb5c0c5f5..ffd5bf294 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -806,7 +806,8 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in int ellipticcurvelist_length = (*(sdata++) << 8); ellipticcurvelist_length += (*(sdata++)); - if (ellipticcurvelist_length != size - 2) + if (ellipticcurvelist_length != size - 2 || + ellipticcurvelist_length < 1) { *al = TLS1_AD_DECODE_ERROR; return 0; @@ -1065,7 +1066,8 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in unsigned char *sdata = data; int ecpointformatlist_length = *(sdata++); - if (ecpointformatlist_length != size - 1) + if (ecpointformatlist_length != size - 1 || + ecpointformatlist_length < 1) { *al = TLS1_AD_DECODE_ERROR; return 0;